Critical vulnerability in Post SMTP WordPress Plugin actively exploited
Take action: If you use the Post SMTP plugin on your WordPress, this is URGENT. Update immediately to version 3.6.1, because any attacker can simply trigger a password reset request and then find the reset link to change your passwords. This is not a dril, you are being actively hacked.
Learn More
WordPress security firm Wordfence is reporting an active exploitation of an account takeover vulnerability affecting the Post SMTP plugin, a widely used email delivery solution.
Post SMTP is an email delivery plugin designed to replace WordPress's default wp_mail() PHP mail function with a more reliable SMTP mailer implementation. The plugin provides email management capabilities including custom SMTP configuration, email logging and tracking, delivery failure alerts, backup SMTP server support, mobile application integration, and detailed analytics on email delivery success rates.
The flaw is tracked as CVE-2025-11833 (CVSS score 9.8). It allows unauthenticated attackers to view email logs containing password reset links, enabling site compromise through triggering a password reset, then accessing the link from the logs.
Post SMTP's PostmanEmailLogs class constructor is responsible for displaying logged email messages when administrators need to review sent communications. The developers failed to implement proper authorization checks in the function that handles email log display requests. When the plugin receives a request to view a logged email through specific URL parameters (page=postman_email_log, view=log, and a log_id parameter), it retrieves and displays the requested email content without any authorization.
Attackers began actively exploiting this vulnerability on November 1, 2025. Approximately half of the install base of 400,000 sites are still running vulnerable versions, at least 210,000 WordPress installations remain at immediate risk of complete takeover.
Affected versions are all versions up to and including 3.6.0 Post SMTP version 3.6.1, released on October 29, 2025, contains the security fix for this vulnerability.
WordPress site administrators using Post SMTP must immediately update to version 3.6.1 or later through the WordPress admin dashboard Organizations should conduct security audits of their WordPress installations to identify any signs of compromise, including reviewing user accounts for unauthorized administrator accounts, examining recent plugin and theme installations for malicious code, checking website content for unauthorized modifications or injected scripts, analyzing server logs for suspicious access patterns, and verifying that all legitimate administrator accounts have not had their passwords changed without authorization.
