EUVD-2026-12835Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 5.3 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N indicates a medium-severity vulnerability requiring network access, subscriber-level authentication, and relatively high attack complexity, but with high integrity impact and no confidentiality or availability impact. The attack complexity is marked as 'High' because successful exploitation requires the victim administrator to upgrade to the Pro version and run the wizard after the configuration has been tampered with, adding a user interaction dependency. The vulnerability is not listed as actively exploited in known KEV catalogs, and no public proof-of-concept appears to be widely distributed, reducing immediate real-world exploitation likelihood. However, the presence of the vulnerability in production code across all versions through 3.8.0, combined with the relatively straightforward nature of the flaw (missing authorization check), suggests moderate EPSS exploitation probability. The real-world risk is moderate rather than critical because: (1) exploitation requires subscriber-level access, not complete anonymity, (2) the attack requires post-upgrade wizard interaction from an administrator, (3) the impact is limited to email configuration rather than data breach or system compromise, and (4) Wordfence documentation confirms a patch path exists. This is a legitimate priority for patching but not an emergency. |
| Exploit ScenarioDerived | An attacker with a subscriber account on a WordPress site running Post SMTP crafts a specially constructed URL containing forged Office 365 OAuth parameters and shares it with a site administrator or entices them to click it through social engineering. When the administrator later upgrades to the Pro version and runs the Microsoft 365 SMTP configuration wizard, the tampered settings cause the wizard to display the attacker's Azure application as the legitimate configuration, potentially leading the administrator to grant permissions to the attacker's Microsoft account during setup. The attacker then gains the ability to monitor or intercept all outgoing email from the WordPress site via their controlled Azure application, or perform credential harvesting during the OAuth flow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
The Post SMTP WordPress plugin for versions up to 3.8.0 contains an authorization bypass vulnerability in the Office 365 OAuth redirect handler that allows authenticated subscribers and above to overwrite sensitive SMTP configuration without proper capability checks or nonce validation. An attacker with subscriber-level access can craft a malicious URL to inject attacker-controlled Azure app credentials into the site's Microsoft 365 configuration, potentially causing administrators to unknowingly connect to the attacker's account during Pro wizard setup. This vulnerability has a CVSS score of 5.3 and is classified as CWE-862 (Missing Authorization), with active evidence of the vulnerable code path present in the plugin repository.
RemediationAI
Sites running Post SMTP should immediately upgrade to version 3.8.1 or later, which patches the authorization bypass by adding proper current_user_can() capability checks and nonce verification to the handle_office365_oauth_redirect() function. The patch is available in the official WordPress plugin repository and the changeset referenced in Wordfence's vulnerability disclosure (https://www.wordfence.com/threat-intel/vulnerabilities/id/323436b5-fbfe-4923-8b08-93c1fcabc016). For sites unable to upgrade immediately, administrators should restrict the subscriber role's access to WordPress admin pages using role management plugins until patching is possible, and should avoid upgrading to or enabling the Pro tier wizard feature until the vulnerability is patched. Additionally, administrators should audit any recent changes to SMTP configuration via Settings logs or WordPress audit trails to identify potential exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the handle_office365_oauth_redirect() function within the Post SMTP plugin (cpe:2.3:a:saadiqbal:post_smtp_–_complete_email_deliverability_and_smtp_solution_with_email_logs,_alerts,_backup_smtp_&_mobile_app), specifically as documented in Postman/Wizard/NewWizard.php. The function is hooked to the WordPress admin_init action, which fires for all authenticated admin screen access, but lacks both current_user_can() capability checks and nonce verification. This represents a classic CWE-862 (Missing Authorization) flaw where a security-sensitive operation (OAuth credential storage) is exposed without proper access control validation. The vulnerability targets the Microsoft 365 SMTP configuration mechanism, which is part of the Pro tier feature set and handles OAuth tokens and user email storage in WordPress options.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_office365_oauth_redirect() function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admin_init without any current_user_can() check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro.
Executive ViewAI
Organizations using all should be aware of moderate risk from CVE-2026-2559, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Post SMTP WordPress Plugin XSS Vulnerabilities
View all 2More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB