Introduction
On any WordPress site running a vulnerable version of the Post SMTP plugin, attackers can retrieve password reset emails and take over administrator accounts. The plugin has over 400,000 active installations, so this flaw exposes a huge number of WordPress sites to unauthorized access and account compromise.
Post SMTP is a widely used WordPress plugin for SMTP email delivery, with logging, alerts, and backup SMTP. Sites of every size depend on it, from small blogs to enterprise deployments, so a flaw in this plugin has wide reach.
Technical Information
CVE-2025-11833 is caused by a missing capability check in the __construct function of the Post SMTP plugin's email log handler. In all versions up to and including 3.6.0, the plugin does not verify user permissions before it initializes access to the email log endpoints. As a result, unauthenticated users can directly access REST API endpoints that expose the contents of logged emails.
The vulnerable code is in PostmanEmailLogs.php#L51 (v3.5.0).
With no permission check in place, attackers can send HTTP requests straight to the relevant REST API endpoints and retrieve any email the plugin has logged. That includes password reset emails and the reset links inside them. With one of those links, an attacker can reset the password for any user, administrators included, and take full control of the WordPress site.
The vulnerability is classified as CWE-862 (Missing Authorization). The attack needs only network access to the affected WordPress instance. It does not require authentication or any prior knowledge of the system.
Affected Systems and Versions
- Product: Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App (WordPress plugin)
- Affected versions: All versions up to and including 3.6.0
- Vulnerable configuration: Any WordPress installation with the affected plugin version active
Vendor Security History
The Post SMTP plugin has a history of critical authorization and REST API exposure vulnerabilities:
- CVE-2025-24000: Missing authorization allowed authenticated users to access email logs
- CVE-2023-6875: Type juggling in a REST endpoint allowed unauthenticated API key reset and log access
The vendor has issued patches after these disclosures, but similar issues have recurred, which points to a need for better security review and development practices.
