What is the CVSS score of EUVD-2026-12835?

EUVD-2026-12835 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-12835?

Organizations using all should be aware of moderate risk from CVE-2026-2559, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate EUVD-2026-12835?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress EUVD-2026-12835

| CVE-2026-2559 MEDIUM

Missing Authorization (CWE-862)

2026-03-18 Wordfence

WordPress Microsoft Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12835

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_office365_oauth_redirect() function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admin_init without any current_user_can() check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro.

AnalysisAI

The Post SMTP WordPress plugin for versions up to 3.8.0 contains an authorization bypass vulnerability in the Office 365 OAuth redirect handler that allows authenticated subscribers and above to overwrite sensitive SMTP configuration without proper capability checks or nonce validation. An attacker with subscriber-level access can craft a malicious URL to inject attacker-controlled Azure app credentials into the site's Microsoft 365 configuration, potentially causing administrators to unknowingly connect to the attacker's account during Pro wizard setup. This vulnerability has a CVSS score of 5.3 and is classified as CWE-862 (Missing Authorization), with active evidence of the vulnerable code path present in the plugin repository.

Technical ContextAI

The vulnerability exists in the handle_office365_oauth_redirect() function within the Post SMTP plugin (cpe:2.3:a:saadiqbal:post_smtp_–_complete_email_deliverability_and_smtp_solution_with_email_logs,_alerts,_backup_smtp_&_mobile_app), specifically as documented in Postman/Wizard/NewWizard.php. The function is hooked to the WordPress admin_init action, which fires for all authenticated admin screen access, but lacks both current_user_can() capability checks and nonce verification. This represents a classic CWE-862 (Missing Authorization) flaw where a security-sensitive operation (OAuth credential storage) is exposed without proper access control validation. The vulnerability targets the Microsoft 365 SMTP configuration mechanism, which is part of the Pro tier feature set and handles OAuth tokens and user email storage in WordPress options.

RemediationAI

Sites running Post SMTP should immediately upgrade to version 3.8.1 or later, which patches the authorization bypass by adding proper current_user_can() capability checks and nonce verification to the handle_office365_oauth_redirect() function. The patch is available in the official WordPress plugin repository and the changeset referenced in Wordfence's vulnerability disclosure (https://www.wordfence.com/threat-intel/vulnerabilities/id/323436b5-fbfe-4923-8b08-93c1fcabc016). For sites unable to upgrade immediately, administrators should restrict the subscriber role's access to WordPress admin pages using role management plugins until patching is possible, and should avoid upgrading to or enabling the Pro tier wizard feature until the vulnerability is patched. Additionally, administrators should audit any recent changes to SMTP configuration via Settings logs or WordPress audit trails to identify potential exploitation attempts.