CVE-2026-81278: CWE-862 Missing Authorization in WPExperts Post SMTP

This vulnerability (CWE-862) in WPExperts Post SMTP version 4.0.0 involves missing authorization checks, which can be exploited due to incorrectly configured access control security levels. The issue affects exactly version 4.0.0 and beta.1. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires low privileges but no user interaction. The impact is limited to integrity and availability, with no confidentiality impact reported. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions affecting the integrity and availability of the Post SMTP plugin. There is no impact on confidentiality. The medium severity reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor WPExperts communications for updates and apply any future patches promptly.