Loading vulnerability…
Authentication bypass / privilege escalation in Post SMTP WordPress plugin email log REST API
CVE-2025-24000 affects the Post SMTP WordPress plugin through version 3.2.0. The issue is an authorization flaw in the plugin’s REST API permission handling for email log access, specifically described in reporting as the get_logs_permission function. The vulnerable logic checked only whether the requester was authenticated (for example, via a logged-in WordPress session) and did not verify that the user had the required administrative role or capabilities. As a result, low-privileged authenticated users, including Subscriber-level accounts, could access administrator-intended REST API endpoints such as the email log retrieval functionality. Because Post SMTP logs email content, the exposed data could include sensitive messages such as password reset emails for privileged accounts, creating a practical path from low-privilege access to full site compromise.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The primary impact is unauthorized access to Post SMTP email logs, resulting in disclosure of sensitive email content. Where those logs contain password reset emails or similar administrative workflow messages, an attacker can use the exposed reset material to change administrator credentials and take over the WordPress site. In practice, the flaw enables privilege escalation from a basic authenticated account to full administrative control. This affects confidentiality of logged mail, integrity of account-management workflows, and overall site integrity.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the Post SMTP plugin or otherwise block access to its sensitive REST API endpoints until the update can be applied. Restrict low-privilege account creation and review existing Subscriber and other non-admin accounts for abuse. Monitor for requests to Post SMTP log-related endpoints, especially email log retrieval paths, and rotate administrator credentials if exposure of password reset emails is suspected.
Patch, then assume compromise.
Upgrade the Post SMTP plugin to version 3.3.0 or later. Reporting indicates the vendor patched the issue by restricting sensitive REST API endpoints to users with appropriate administrative privileges and capability checks. After upgrading, administrators should review plugin and web server logs for suspicious access to Post SMTP REST API endpoints and inspect administrator accounts and password reset activity for signs of compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.