CVE-2026-7621 is a missing authorization vulnerability (CWE-862) in the SMTP2GO for WordPress – Email Made Easy plugin. The flaw allows authenticated users with low-level privileges (subscriber and above) to bypass proper authorization controls and either delete all SMTP log records or export sensitive log data in CSV format. The vulnerability affects all plugin versions up to and including 1.16.0. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. No official patch or remediation guidance has been provided yet.

An attacker with subscriber-level access can delete all SMTP log records, potentially disrupting email logging and auditing. Additionally, they can export sensitive SMTP log data, including recipient and sender email addresses, message subjects, and API response data, which may expose sensitive information. There is no indication of impact on confidentiality beyond the log data, nor on availability or integrity of other plugin functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to SMTP log access. Avoid granting unnecessary privileges to low-level users. Follow updates from the vendor for an official patch or mitigation instructions.