The Gravity SMTP plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in versions up to and including 2.1.4. This flaw allows authenticated users with low privileges (subscriber-level and above) to perform unauthorized actions such as uninstalling and deactivating the plugin and deleting its options. The vulnerability is also exploitable through CSRF, increasing the risk of unauthorized changes without user interaction. The CVSS 3.1 score of 7.1 reflects a network attack vector with low attack complexity, requiring privileges but no user interaction, impacting integrity and availability. There is no vendor advisory or patch available at this time.

An attacker with subscriber-level access or higher can disrupt the functionality of the Gravity SMTP plugin by uninstalling or deactivating it and deleting its configuration options. This compromises the integrity of the plugin's operation and availability of its services on the affected WordPress site. There is no direct confidentiality impact reported. Exploitation via CSRF means that an attacker could potentially trigger these actions without direct interaction from the victim beyond being authenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and consider disabling or removing the Gravity SMTP plugin if possible. Monitor for suspicious activity related to plugin management actions. Avoid clicking on untrusted links while authenticated to reduce CSRF risks.