Postie WordPress plugin CVE-2026-100175

Exploitation requires that the Postie plugin (≤1.9.87) is installed and configured to retrieve/process incoming email, because the vulnerable code path is the ?postie=get-mail mail-fetch endpoint, which performs no capability check and is reachable by unauthenticated users. The attacker must get a crafted email - with a malicious URL in the body that the autolink routine (lib/autolink.php) turns into an unescaped href - into the mailbox Postie monitors; the email processing path strips WordPress's kses output filters before saving, so the raw markup is stored as post content. Script execution then requires a user (visitor or admin) to subsequently load the injected page. Limiting factors: the attack is inert unless mail-processing is actively configured (a non-default operational mode, consistent with AC:H), the payload must reach the monitored mailbox, and impact is confined to browser-context script execution. The only complete fix indicated by the evidence is updating past 1.9.87 (SVN changeset 3751269).

This is a medium-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). The signals partially conflict: the vector is network-reachable and unauthenticated (AV:N/PR:N), which raises concern, but AC:H reflects a real-world constraint - the attack only works when Postie is actually installed and configured to fetch/process incoming email, so the ?postie=get-mail code path is live. No CISA KEV listing and no public exploit code were identified, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from these sources - this is a notable data gap rather than evidence of low risk. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a genuine but non-urgent issue: real, remotely injectable, but gated by a non-default deployment mode and yielding only limited confidentiality/integrity impact (session/DOM-level script execution) with no availability impact. Net: a legitimate patch-this-cycle item, not a drop-everything emergency, and the missing EPSS data should be filled in before final prioritization.

An attacker sends a crafted email whose body contains a malicious URL to the mailbox that a Postie-enabled WordPress site polls (reachable through the unauthenticated ?postie=get-mail endpoint). The autolink routine builds an href from the URL without escaping while the processing path has removed WordPress's kses filters, so the raw markup is saved as post content and the injected script executes whenever a visitor or administrator loads the resulting page. No public proof-of-concept or exploit code was identified in the provided sources; the references are the Wordfence advisory, vulnerable source lines, and the fix changeset.