Post SMTP CVE-2026-81278

Exploitation requires a valid WordPress account with at minimum subscriber-level privileges, consistent with PR:L in the CVSS vector. The Post SMTP plugin must be installed, active, and at version 4.0.0 through beta.1. No special server-side configuration beyond a default plugin installation is required. No administrator interaction or victim user interaction is needed. Exploitation is limited primarily by the authentication prerequisite: WordPress sites with closed user registration, no external accounts, or restricted network access have materially reduced exposure. Sites permitting open public registration face the broadest attack surface.

The CVSS 5.4 (Medium) rating reflects the PR:L requirement, which meaningfully limits exposure to authenticated users and rules out unauthenticated mass exploitation. With AV:N and AC:L, the attack path is technically straightforward for any WordPress account holder, including subscriber-level users obtainable through open registration. No CISA KEV listing exists and no public exploit has been identified, placing this in a lower-urgency tier absent specific threat intelligence. Even a mid-sized municipal IT team in mielec operating a WordPress-based communications portal should treat this as a routine but worthwhile patching priority, particularly if user registration is open, since SMTP credential tampering can cascade into phishing facilitation or operational email disruption. The I:L and A:L impact metrics confirm an attacker can degrade but not fully compromise the system; the absence of C impact removes data-exfiltration risk from the threat model. Real-world risk is moderate and strongly context-dependent on whether untrusted users hold WordPress accounts.

An attacker registers or otherwise obtains a low-privilege subscriber-level WordPress account on a target site running Post SMTP 4.0.0 through beta.1. The attacker sends a crafted authenticated request to an unprotected plugin action endpoint - no elevated role or administrator interaction required - and the missing authorization check allows the request to succeed. The attacker overwrites SMTP server credentials with attacker-controlled values, redirecting outbound email through a malicious relay or cutting off email delivery entirely. No public exploit code has been identified, but the attack requires only standard authenticated HTTP requests reproducible from publicly documented WordPress AJAX patterns.