PT-2025-11223 · WordPress · Post Smtp

Denver Jackson · Published 2025-03-13 · Updated 2025-09-11 · CVE-2025-24000

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Post SMTP plugin for WordPress (affected versions not specified)

Description The Post SMTP plugin for WordPress is subject to a security issue that allows for full site takeover. Approximately 400,000 WordPress sites are potentially at risk. This issue is actively being exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Missing Authorization

Weakness Enumeration

CWE-288

CWE-862

Related Identifiers

BDU:2025-09371

CVE-2025-24000

Affected Products

Post Smtp

References · 25

• https://nvd.nist.gov/vuln/detail/CVE-2025-24000 · Security Note
• https://bdu.fstec.ru/vul/2025-09371 · Security Note
• https://twitter.com/CVEnew/status/1953506238072807632 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1949175075329995156 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1949800195476123804 · Twitter Post
• https://twitter.com/wordpressved/status/1959816455761109021 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1948638970340147491 · Twitter Post
• https://twitter.com/dCypherIO/status/1949839765395632466 · Twitter Post
• https://twitter.com/Pressidium/status/1950296219718136209 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/post-smtp/vulnerability/wordpress-post-smtp-3-2-0-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/attefall/status/1948610394546720772 · Twitter Post
• https://twitter.com/cyashadotcom/status/1949493824641724599 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1m9xpwg/security_flaw_in_post_smtp_plugin_puts_over_200k · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/post-smtp/post-smtp-320-missing-authorization-to-authenticated-subscriber-account-takeover-via-email-log-exposure · Note
• https://reddit.com/r/Action1/comments/1mofh04/august_patch_tuesday_updates · Reddit Post