CVE-2024-6694: 
WordPress vulnerability analysis and mitigation

The WP Mail SMTP plugin for WordPress contains an information exposure vulnerability (CVE-2024-6694) affecting all versions up to and including 4.0.1. The vulnerability was discovered and reported by Wordfence, with the initial disclosure on July 20, 2024 (NVD Database).

The vulnerability stems from the plugin exposing the SMTP password in the SMTP Password field when viewing the settings. This exposure occurs due to improper password handling, classified as CWE-257 (Storing Passwords in a Recoverable Format). The vulnerability has been assigned a CVSS v3.1 base score of 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (NVD Database).

The vulnerability allows authenticated attackers with administrative-level access to view the SMTP password for the configured server. While the impact is generally limited due to the high-privilege requirement, it could be particularly concerning in scenarios where an administrator account becomes compromised, especially in restricted environments (NVD Database).

The vulnerability requires an attacker to have administrative-level access to the WordPress installation. The exploitation is straightforward once this access is obtained, as it only requires viewing the plugin settings page (NVD Database).

Users should update to a version newer than 4.0.1 of the WP Mail SMTP plugin to address this vulnerability. The fix has been implemented in the plugin's codebase as evidenced by the changes in the OptionsAbstract.php file (WordPress Plugin).