The WP Mail Gateway plugin for WordPress versions up to and including 1.8 has a vulnerability due to a missing capability check on the wmg_save_provider_config AJAX action. This allows authenticated users with Subscriber-level access or higher to update SMTP settings and redirect mail. An attacker can exploit this to escalate privileges by triggering a password reset email and gaining access to an administrator's account.