Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
easy-wp-smtp · plugin
Known security vulnerabilities for Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more. Find out in seconds which version runs on your site with WP Lens.
6 known vulnerabilities
2 exploitable without logging in · 1 with public exploit code · latest Jun 13, 2024
Listed on wordpress.org · latest 2.15.1 · last updated Aug 12, 2026 · 500K+ installs
wordpress.org status checked on Oct 5, 2026
Vulnerabilities
- High 8.8
CVE-2022-42699high privilege≤ 1.5.1
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
- High 8.1
CVE-2022-45829high privilege≤ 1.5.1
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
- High 7.5
CVE-2020-35234unauthenticated
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.
- Medium 6.5
CVE-2022-45833high privilege≤ 1.5.1
WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
- Medium 6.1
CVE-2017-7723unauthenticated · needs a click
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
- Low 2.7
CVE-2024-3073high privilege≤ 2.3.0
Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).