KEVIntel
PRO Back to KEVs
9.8
CVSS
Critical

CVE-2023-6875

PUBLISHED

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to...

Exploited in the wild Remote Low complexity No user interaction
Vendor
wpexpertsio
Product
POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
Published
Jan 11, 2024
EPSS
93.7% · 100% pctl

Automate this intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot sensor data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.

wordpress nuclei_scanner

Weaknesses (CWE)

  • CWE-639

    The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

  • CWE-862

    The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2025-04-25 00:00:00 UTC · Source

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
The Shadowserver (via CIRCL) First 2026-06-04 00:00 UTC

Scanner integrations

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6875.yaml Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

gbrsh/CVE-2023-6875

github · Created 2024-01-27 14:20:51 UTC · 6 stars

Exploit for CVE-2023-6875 - Unauthorized Account Takeover.

UlyssesSaicha/CVE-2023-6875

github · Created 2024-01-13 15:23:17 UTC · 25 stars

CVE-2023-6875 PoC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel