WP eCommerce Easy WP SMTP

Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)

WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.

Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection

WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal

XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.

Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI