CVE-2025-11833

CVE-2025-11833 is a missing-authorization flaw (CWE-862) in the Post SMTP WordPress plugin: in all versions up to and including 3.6.0, the email-log handling set up in the plugin's __construct function is registered without a capability check, so the log-viewing functionality effectively accepts requests from anyone. Any unauthenticated visitor who can reach the site can therefore read arbitrary emails logged by Post SMTP, including WordPress password-reset emails containing password reset links. By harvesting a reset link addressed to an administrator, an attacker can complete the password reset and take over the account, a full site-admin compromise reflected in the critical 9.8 CVSS score. Any WordPress site running Post SMTP 3.6.0 or earlier is affected, on the order of hundreds of thousands of installations. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is documented yet, but the EPSS of 51% (99th percentile) signals a high probability of exploitation within the next 30 days.

What to do: Update the Post SMTP plugin to the latest release, since every version through 3.6.0 is vulnerable. Until patched, purge stored email logs, consider temporarily disabling the plugin or blocking its log endpoints with WAF rules, and review the log for password-reset emails sent to administrators; treat any admin account whose reset emails appear in the log as potentially compromised, rotate those credentials, and enable two-factor authentication.