Unauthenticated user was able to exploit the admin page because it was possible to view/delete the log, import/export the configuration of the plugin and update WordPress options in the database.
This vulnerability affects the following application versions:
- Easy WP SMTP 1.2.8
- Easy WP SMTP 1.2.9
- Easy WP SMTP 1.3.0
- Easy WP SMTP 1.3.1
- Easy WP SMTP 1.3.2
- Easy WP SMTP 1.3.3
- Easy WP SMTP 1.3.4
- Easy WP SMTP 1.3.5
- Easy WP SMTP 1.3.6
- Easy WP SMTP 1.3.7
- Easy WP SMTP 1.3.8
- Easy WP SMTP 1.3.8.1
- Easy WP SMTP 1.3.9