Exploited ‘Post SMTP’ Plugin Flaw Exposes WordPress Sites to Takeover

According to SecurityWeek, a critical vulnerability in the WordPress Post SMTP plugin exposes hundreds of thousands of sites to takeover by letting attackers read arbitrary logged emails, including password resets. The flaw, tracked as CVE-2025-11833 with a CVSS of 9.8, affects Post SMTP versions up to 3.6.0 and was fixed in version 3.6.1 on 29 October, with exploitation said to have begun roughly three days after patches were released.

Defiant notes that in-the-wild attacks have been blocked to date at over 4,500 attempts. The plugin has more than 400,000 active installations, and WordPress statistics cited by SecurityWeek suggest roughly 200,000 sites may be exposed to takeover because of the bug. The flaw was reported by a researcher named Netranger through the Wordfence Bug Bounty Program, which awarded a $7,800 bounty for the discovery. Written by Ionut Arghire, 5 November 2025.