Post SMTP CVE-2026-48838

Exploitation requires (1) a target WordPress site running Post SMTP plugin version 3.6.2 or earlier with the vulnerable endpoint network-reachable, and (2) victim interaction - per CVSS UI:R, an authenticated user (typically a WordPress administrator, since that is where the scope-changed impact materializes) must visit an attacker-crafted URL, open a page containing the injected payload, or otherwise trigger the rendering of attacker-supplied input. No authentication is required of the attacker (PR:N), and no special plugin configuration is documented as a prerequisite in the available intelligence; the practical limit on exploitation is the social-engineering step needed to land the payload in a privileged user's session.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L produces a 7.1 (High) driven primarily by the scope change and unauthenticated network reach, but the UI:R requirement (a victim must click or visit a crafted link/page) and the limited C/I/A impacts keep real-world severity below remote code execution class bugs. There is no EPSS score, KEV listing, or public POC in the provided intelligence, so this looks like a Patchstack-disclosed XSS without observed in-the-wild abuse - meaningful for sites with high-value admin sessions (where stolen cookies or forged admin actions could escalate to full site takeover) but not an emergency for the broader Post SMTP install base. The single Patchstack reference and absence of a vendor advisory link in the data mean the exact sink and payload conditions are not independently verifiable from the input; defenders should treat this as a credible but moderately prioritized patch task rather than a same-day fire drill.

An attacker crafts a URL or submission targeting a vulnerable unauthenticated Post SMTP endpoint with an embedded JavaScript payload, then lures a logged-in WordPress administrator to click the link via phishing or a comment on the same site. When the admin's browser renders the response, the injected script executes in the WordPress origin and can exfiltrate session cookies, issue authenticated wp-admin requests, or plant a persistent backdoor user - all without the attacker needing valid credentials.