CVE-2026-6963 is a missing authorization vulnerability (CWE-862) in the WP Mail Gateway WordPress plugin by shahariaazam. The issue arises from the lack of a capability check on the wmg_save_provider_config AJAX action, allowing authenticated users with low privileges (Subscriber and above) to update SMTP mail settings. This unauthorized modification can be exploited to redirect password reset emails, enabling privilege escalation to administrator accounts. The vulnerability affects all plugin versions up to and including 1.8 and has a CVSS 3.1 base score of 8.8, indicating a high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can exploit this vulnerability to change SMTP settings and redirect emails, including password reset emails. This can lead to privilege escalation by allowing the attacker to gain control over administrator accounts. The impact affects confidentiality, integrity, and availability of the affected WordPress site’s mail functionality and administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access and above to trusted users only. Monitor plugin updates from shahariaazam for a security patch addressing this missing authorization issue.