CVE-2025-62123: CSRF in WP Gmail SMTP Plugin

The CSRF vulnerability in WP Gmail SMTP allows an attacker to craft malicious requests that appear to originate from a legitimate user. If a user is logged into WordPress and visits a crafted link, the attacker can execute actions as that user without their knowledge. This could include modifying SMTP settings, adding or removing email accounts, or potentially gaining access to sensitive email data. The impact is amplified if the plugin is used in environments with shared hosting or where user permissions are not strictly controlled, as an attacker could potentially compromise multiple WordPress installations.

1. Reserved2025-10-07
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-62123 is to upgrade the WP Gmail SMTP plugin to a version containing the fix. If upgrading immediately is not possible due to compatibility concerns or breaking changes, consider implementing temporary workarounds such as adding nonce validation to all sensitive plugin actions. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also help to block malicious requests. Regularly review plugin settings and user permissions to ensure they are properly configured.

Active installs

1KNiche

Plugin rating