CVE-2025-11833 (CVSS 9.8): Critical Flaw Exposes 400,000 WordPress Sites to Unauthenticated Account Takeover

CVE-2025-11833 (CVSS 9.8) is a critical Missing Authorization flaw found in the Post SMTP plugin, which is used by over 400,000 WordPress sites to ensure reliable email delivery. The vulnerability allows unauthenticated attackers to read sensitive emails logged by the plugin, including password reset links sent to administrators, enabling a complete account takeover. The flaw affects versions up to and including 3.6.0, and a fix is published in version 3.6.1, which site administrators should apply immediately.

Security researchers note the exploit is simple to leverage, with attackers able to bypass the normal security model by accessing the plugin’s email logs. According to Wordfence, there have been attacks blocked against vulnerable sites in the past 24 hours, underscoring the urgency of updating. This type of unauthenticated access to password reset links represents one of the most severe threats in the WordPress ecosystem.