Critical Site Takeover Flaw Affects 400K WordPress Sites

Elizabeth Montalbano reports that a critical flaw in the Post SMTP WordPress plugin has affected about 400,000 sites, enabling unauthenticated account and website takeover. The vulnerability, tracked as CVE-2025-11833, carries a 9.8 CVSS score and stems from missing capability checks in the __construct function across versions up to and including 3.6.0, according to Wordfence's advisory.

Attackers began targeting the flaw on 1 November, after Wordfence received a report on 11 October through its bug bounty programme, with more than 4,500 attacks already blocked by Wordfence protections. A fix was released as version 3.6.1 on 29 October, and Wordfence has since issued a firewall rule for Premium, Wordfence Care and Wordfence Response users, with free users to receive protection on 14 November.

The flaw allows unauthenticated actors to reset passwords and take over sites, potentially uploading malicious files and redirecting visitors, and researchers warn that a large campaign is likely to start in the coming days.