Critical WordPress Post SMTP Plugin Vulnerability Puts 400,000 Sites at Risk of Account Takeover

A critical vulnerability in the WordPress Post SMTP plugin has been linked to more than 400,000 active installations, enabling unauthenticated attackers to access email logs and carry out account takeover attempts, with CVE-2025-11833 and a CVSS of 9.8. Researchers report over 4,500 exploitation attempts since 1 November 2025, highlighting an active campaign.

The issue arises from a missing capability check in the PostmanEmailLogs class constructor, which fails to verify user permissions before displaying logged messages, allowing unauthenticated access via specific URL parameters and exposing password reset emails. Wordfence telemetry indicates attackers began targeting the vulnerability in early November, and Wordfence Premium users gained firewall protection on 15 October 2025, with free users protected from 14 November 2025.

The vendor released a patched version, Post SMTP 3.6.1, on 29 October 2025, addressing the authorization bypass; the researcher known as netranger received USD 7,800 through Wordfence’s Bug Bounty Program. Administrators should update to 3.6.1 or later and verify installation status to mitigate the immediate threat, which remains actively exploited according to the report. according to Wordfence’s Bug Bounty Program