The Gravity SMTP plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in versions up to 2.1.4. The plugin fails to properly verify that a user is authorized to perform sensitive actions such as uninstalling or deactivating the plugin and deleting plugin options. This flaw allows any authenticated user with subscriber-level privileges or above to perform these actions without proper permission checks. Additionally, the vulnerability is exploitable through a CSRF vector, increasing the risk of unauthorized plugin manipulation. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with subscriber-level access or higher can uninstall or deactivate the Gravity SMTP plugin and delete its options, potentially disrupting email functionality on the affected WordPress site. The lack of proper authorization checks combined with CSRF exploitation means attackers can perform these actions without direct user interaction beyond authentication. This can lead to denial of service of the plugin's functionality and possible configuration loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to plugin management. Consider disabling the plugin if not essential or applying custom authorization checks as a temporary measure.