CVE-2026-32519: WordPress Bit SMTP Plugin
CVE-2026-32519 affects the Bit SMTP plugin for WordPress from Bit Apps and is classified as Incorrect Privilege Assignment (CWE-266), which allows privilege escalation. Patchstack and CISA-ADP report a CVSS 3.1 base score of 9.0 (Critical) for a network-reachable attack requiring no privileges or user interaction. No fixed version or confirmed exploitation appears in the record.
Overview
CVE-2026-32519 is a privilege escalation issue in the Bit SMTP plugin for WordPress, which is published by Bit Apps. The record classifies it as Incorrect Privilege Assignment (CWE-266) and reports versions up to and including 1.2.2 as affected.
Impact
- Patchstack and CISA-ADP report a CVSS 3.1 base score of 9.0 (Critical) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
- The vector indicates a network attack vector, high attack complexity, no privileges required and no user interaction, with scope change and high impact on confidentiality, integrity and availability.
- Privilege escalation may let a party with fewer rights reach capabilities reserved for higher roles. The record does not describe the affected function, so the exact outcome is unknown.
Affected products and versions
- Bit Apps Bit SMTP (bit-smtp), from an unspecified starting version through 1.2.2.
- The record gives the start of the range as n/a, so earlier versions can be neither confirmed nor excluded from the data.
- No fixed version is listed. The absence of a fixed version does not mean that no fix exists.
Exploitation status
- The record shows CISA KEV as not listed. No active exploitation is confirmed in the sources consulted.
- The record gives an EPSS probability of 0.00373 and a percentile of 0.29423. SSVC lists exploitation as none and automatable as no.
Remediation and mitigation
- Identify WordPress sites that run Bit SMTP and record the installed version, giving priority to any version at or below 1.2.2.
- Check the Patchstack entry and the vendor's channels for an updated release, and apply it as soon as it is available.
- If no fixed version is available and the plugin is not essential, consider deactivating and removing it, or move to a maintained alternative.
- Restrict administrative roles to people who need them and review recent role assignments.
Detection guidance
- Review user accounts for unexpected role or capability changes, newly created administrator accounts and privilege changes that do not match approved activity.
- Review web server and WordPress logs for unusual activity around the plugin and its administrative endpoints, at a high level.
- Correlate these findings with the inventory of installed plugin versions.
Limitations of the available information
- The record does not describe the vulnerable function, any preconditions beyond the CVSS vector, or a fixed version.
- The start of the affected range is given as n/a.
- The EPSS entry is dated 2026-10-13, which is later than the 2026-03-25 publication date, so its currency should be verified at the source.
- The record title refers to broken authentication while the description refers to incorrect privilege assignment. This analysis follows the description.
Frequently asked questions
What is CVE-2026-32519?
It is a privilege escalation vulnerability in the Bit SMTP WordPress plugin from Bit Apps, classified as Incorrect Privilege Assignment (CWE-266).
Which versions are affected?
The record lists Bit SMTP versions through 1.2.2 as affected, but the starting version is given as n/a, so the full range is unknown.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no active exploitation is confirmed in the sources consulted.
Is there a fixed version?
No fixed version is listed in the record. Check the Patchstack entry and the vendor for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.