CVE-2023-6875

🗓️ 11 Jan 2024 08:33:06Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 207 Views🌐 WEB

POST SMTP Mailer plugin for WordPress - Unauthorized access and data modification vulnerabilit

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Missing Authorization in Wpexperts Post_Smtp	5 Feb 202409:44	–	githubexploit
GithubExploit	Exploit for Missing Authorization in Wpexperts Post_Smtp	13 Jan 202415:23	–	githubexploit
GithubExploit	Exploit for Missing Authorization in Wpexperts Post_Smtp	27 Jan 202414:20	–	githubexploit
BDU FSTEC	The vulnerability of the POST SMTP Mailer plugin in the WordPress content management system allows a hacker to bypass the API key and gain unauthorized access to protected information.	24 Jan 202400:00	–	bdu_fstec
Circl	CVE-2023-6875	12 Jan 202412:01	–	circl
CNNVD	WordPress Plugin POST SMTP Mailer Cross-Site Scripting Vulnerability	11 Jan 202400:00	–	cnnvd
Cvelist	CVE-2023-6875 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API	11 Jan 202408:33	–	cvelist
Metasploit	Wordpress POST SMTP Account Takeover	29 Nov 202418:54	–	metasploit
Nuclei	WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass	28 Jun 202615:08	–	nuclei
NVD	CVE-2023-6875	11 Jan 202409:15	–	nvd

NVD

Vulners

Node

wpexperts post_smtpRange≤2.8.7wordpress

[
  {
    "vendor": "saadiqbal",
    "product": "Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.8.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af
plugins	www.plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk
packetstormsecurity	www.packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
fcm-token	header	/wp-json/post-smtp/v1/connect-app	Unauthenticated type juggling on connect-app endpoint allows resetting API key and accessing logs.	CWE-862, CWE-639
device	header	/wp-json/post-smtp/v1/connect-app	Unauthenticated type juggling on connect-app endpoint allows resetting API key and accessing logs.	CWE-862, CWE-639
fcm-token	header	/wp-json/post-smtp/v1/get-logs	Unauthenticated access to logs via get-logs endpoint	CWE-862, CWE-639

17 Jun 2026 06:51Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

EPSS0.90339

SSVC

cve-2023-6875 post smtp mailer email log delivery failure notifications wordpress unauthorized access data modification type juggling issue rest endpoint api key authentication site takeover nvd