CVE-2025-24000

🗓️ 07 Aug 2025 16:58:28Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 119 Views🌐 WEB

CVE-2025-24000 WordPress Post SMTP plugin allows account takeover due to authentication bypass issue

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2025-24000	14 Apr 202617:15	–	githubexploit
BDU FSTEC	The vulnerability of the get_details() function in the POST SMTP plugin of the WordPress content management system allows a hacker to escalate their privileges and disclose sensitive information.	4 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-24000	25 Jul 202513:42	–	circl
CNNVD	WordPress Plugin WPExperts Post SMTP 安全漏洞	7 Aug 202500:00	–	cnnvd
CNVD	WordPress WPExperts Post SMTP plugin authentication bypass vulnerability	15 Aug 202500:00	–	cnvd
Cvelist	CVE-2025-24000 WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability	7 Aug 202516:58	–	cvelist
EUVD	EUVD-2025-23940	3 Oct 202520:07	–	euvd
NVD	CVE-2025-24000	7 Aug 202517:15	–	nvd
Patchstack	WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability	21 Jul 202511:08	–	patchstack
Positive Technologies	PT-2025-11223	13 Mar 202500:00	–	ptsecurity

Vulners

Node

saad_iqbal post_smtpRange≤3.2.0wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "post-smtp",
    "product": "Post SMTP",
    "vendor": "Saad Iqbal",
    "versions": [
      {
        "changes": [
          {
            "at": "3.3.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.2.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/post-smtp/vulnerability/wordpress-post-smtp-3-2-0-privilege-escalation-vulnerability

Parameter	Position	Path	Description	CWE
id	query param	/wp-json/psd/v1/get-details	Retrieve admin details with insufficient authorization using id/type parameters	CWE-288
type	query param	/wp-json/psd/v1/get-details	Retrieve admin details with insufficient authorization using id/type parameters	CWE-288

28 Apr 2026 16:11Current

6Medium risk

Vulners AI Score6

CVSS 3.18.8

EPSS0.00222

SSVC