CVE-2023-6875 in the critical feed json
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
published 2024-01-11 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-59079
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 90.3%
- EPSS 90.3% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Timeline
- First public exploit (Metasploit auxiliary/admin/http/wp_post_smtp_acct_takeover)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
90.34% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/admin/http/wp_post_smtp_acct_takeover Wordpress POST SMTP Account Takeover metasploit auxiliary, normal rank, 2024-01-10
- Nuclei template WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Classification
- Weakness
- Technology feeds
References
-
wordfence.com
/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve
third-party-advisory
-
plugins.trac.wordpress.org
/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60
issue-tracking
-
plugins.trac.wordpress.org
/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2Ftrunk
product
-
packetstormsecurity.com
/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2023-6875
- NVD CVE-2023-6875
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.