CVE-2026-6963 is a missing authorization vulnerability (CWE-862) in the WP Mail Gateway WordPress plugin by shahariaazam. The issue arises because the wmg_save_provider_config AJAX action lacks a capability check, allowing authenticated users with low privileges (Subscriber and above) to update SMTP configuration settings. This unauthorized access can be leveraged to redirect emails, including password reset emails, enabling privilege escalation to administrator accounts. The vulnerability affects all versions up to and including 1.8 and has a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

An attacker with at least Subscriber-level access can modify SMTP settings to redirect emails, including password reset emails. This can lead to privilege escalation by allowing the attacker to reset and take over administrator accounts. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious changes to SMTP settings. Consider disabling or removing the WP Mail Gateway plugin if it is not essential.