GoSMTP Plugin Authorization Bypass Enables Admin Takeover

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-111577 is an authorization bypass vulnerability in the GoSMTP WordPress plugin versions before 1.2.5 that allows non-administrator users to modify SMTP configuration settings. The vulnerability stems from insufficient access controls on the plugin's settings management page—the page only checks for the activation capability rather than enforcing administrator-level privileges. This creates a critical privilege escalation vector because attackers with delegated roles (such as editor or contributor) can reconfigure outbound mail delivery, redirecting administrative emails or password reset links to attacker-controlled servers. Any WordPress site using vulnerable versions of GoSMTP is at risk, particularly those with multiple user roles or managed hosting environments where delegated administrators are common.

Casky's 224 mapped skills detect the attack patterns underlying this vulnerability by correlating MITRE ATT&CK technique TA0004 (Privilege Escalation) with CWE-269 (Improper Access Control) indicators. Practitioners using Casky would observe findings flagging unauthorized access to administrative configuration interfaces, detection of role-based access control (RBAC) bypass attempts on sensitive plugin settings pages, and behavioral patterns consistent with credential compromise or account takeover preparation—such as SMTP configuration changes originating from unexpected user roles or IP addresses. Claude's extended reasoning capabilities enable practitioners to understand the attack chain: how initial low-privilege access escalates through configuration manipulation to compromise high-privilege accounts, and what compensating controls or detection strategies would be most effective against this pattern.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111577.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-111577

Casky has 224 skills that investigate the attack patterns behind CVE-2026-111577. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn