Loading vulnerability…
CVE-2023-6875 is a vulnerability in the POST SMTP Mailer plugin for WordPress affecting all versions up to and including 2.8.7. The flaw is caused by a type juggling issue in the connect-app REST endpoint. By exploiting improper type handling during authentication or authorization logic, an unauthenticated attacker can reset the API key used by the plugin’s mailer integration and gain access to plugin log data. Exposed logs may include sensitive email content such as password reset messages, which can then be used to compromise user accounts and take over the affected WordPress site.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit auxiliary module targeting the POST SMTP WordPress plugin (prior to version 2.8.7), exploiting CVE-2023-6875. The exploit enables an unauthenticated attacker to perform an account takeover by resetting the password of any user. It does so by registering a token with the plugin's API, triggering a password reset for a specified username, and then accessing the plugin's email logs via exposed REST API endpoints to retrieve the password reset email and extract the reset URL. The module is written in Ruby and leverages Metasploit's HTTP and WordPress libraries. The main file implements all logic, including endpoint interaction, token management, and log retrieval. The attack vector is network-based, requiring HTTP access to the vulnerable WordPress instance. The exploit is operational, providing a working method for account takeover but not a fully weaponized, customizable payload.
This repository contains a Python proof-of-concept exploit for CVE-2023-6875, targeting the PostSMTP Mailer WordPress plugin (versions <2.8.8). The exploit automates an unauthorized account takeover by abusing the plugin's API endpoints to obtain a password reset token, intercept the reset key from plugin logs, and reset the password for a specified user. The repository consists of a README.md describing the exploit and a single Python script (exploit.py) implementing the attack. The script requires the target URL, username, and new password as arguments, and performs version checking, token acquisition, password reset request, log retrieval, and password change. The attack vector is network-based, exploiting exposed HTTP endpoints on the target WordPress site. The exploit is operational and demonstrates a full account takeover workflow.
This repository contains a Go-based exploit targeting WordPress installations with the Post SMTP plugin (or similar REST API endpoints). The exploit automates a multi-step attack: 1. It probes for accessible Post SMTP API endpoints to place a token and interact with the mail system. 2. It attempts to enumerate the admin username via the REST API, defaulting to 'admin' if not found. 3. It triggers a password reset for the admin account, then retrieves the reset link from the mail logs exposed by the plugin's API. 4. Using the reset link, it sets a new admin password and logs in as the admin user. 5. Finally, it uploads a ZIP file containing a PHP web shell as a WordPress plugin and provides the attacker with a URL to access the shell. The exploit is operational and provides remote code execution via the uploaded shell. The main code is in 'exploit.go', and the repository also includes a README.md with usage instructions. The attack vector is network-based, requiring access to the target's web interface and specific API endpoints. Several fingerprintable endpoints are hardcoded or constructed based on the target domain, including REST API endpoints and the final shell URL.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.