WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)

Summary

CVE	CVE-2022-42699
State	PUBLISHED
Assigner	Patchstack
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-12-06 23:15:10 UTC
Updated	2026-04-28 19:18:51 UTC
Description	Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

Primary CVSS: v3.1 8.8 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-94 | CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	[email protected]	Secondary	9.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	CNA	CVSS	9.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Wp-ecommerce	Easy Wp Smtp	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	WPecommerce Alexanderfoxc	Easy WP SMTP	affected n/a 1.5.1 custom	Not specified

Reference	Source	Link	Tags
WordPress Easy WP SMTP plugin <= 1.5.1 - Auth. Remote Code Execution (RCE) vulnerability - Patchstack	af854a3a-2127-422b-91ae-364da2661108	patchstack.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Tomasz Staszyszyn (Patchstack Alliance) (en)

CNA: Update to 1.5.2 or higher version.

150624 WordPress Easy WP SMTP Plugin: Multiple Vulnerabilities (CVE-2022-42699,CVE-2022-45833,CVE-2022-45829)