Introduction
A critical flaw in the Post SMTP plugin lets attackers escalate privileges from a basic subscriber account to full administrative control on over 400000 WordPress sites. The vulnerability, tracked as CVE-2025-24000, undermines the integrity of password resets and the confidentiality of email logs. On affected sites, it can lead to account takeovers and data breaches.
Post SMTP is a widely used WordPress plugin from WPExperts that handles SMTP email delivery and logging for WordPress sites. It has over 400000 active installations, and many organizations rely on it as a core part of how their sites send email. The plugin's email logging and management features depend on its REST API endpoints, and a flaw in how those endpoints enforce access control created a significant authentication bypass risk.
Technical Information
CVE-2025-24000 comes from the get_logs_permission function in the Post SMTP plugin's REST API. In all versions up to and including 3.2.0, this function only checked whether a user was authenticated, using the WordPress is_user_logged_in() function. It did not check the user's role or capabilities, such as whether the user had administrative privileges. Any logged-in user, down to the lowest privilege level (Subscriber), could therefore reach REST API endpoints meant only for administrators.
The most critical endpoint exposed by this flaw is email log retrieval. An attacker could register as a subscriber on a vulnerable site, log in, and request endpoints like /wp-json/post-smtp/v1/get-details directly to pull the email logs. Those logs include sensitive messages such as password reset emails sent to administrative accounts. By intercepting one of these emails, an attacker could reset the admin password and take full control of the WordPress site.
The root cause is a confusion between authentication and authorization. The plugin treated being logged in as the only gate, instead of using WordPress's capability system (such as current_user_can('manage_options')) to separate privileges properly. The result is a privilege escalation path that is trivial to exploit and can be automated at scale.
This post includes no code snippets, because public sources describe the vulnerable code but do not publish it in full.
Patch Information
The Post SMTP developers fixed the vulnerability in version 3.3.0, which tightens access control on the plugin's REST API endpoints. Before the fix, the function get_logs_permission only checked whether a user was logged in, not what privileges they had. In the patched version, the function allows only users with appropriate administrative privileges to reach sensitive REST API functions.
This change stops low-privileged users from intercepting password reset emails and from performing other critical actions, which mitigates the risk of unauthorized account takeover. Site administrators should upgrade to version 3.3.0 or later to secure their WordPress installations.
Reference: securityonline.info
Detection Methods
To detect unauthorized access to Post SMTP email logs, watch for the indicators of compromise (IoCs) below and set up monitoring in advance. (patchstack.com)
Indicators of Compromise (IoCs)
| Indicator | How to detect it |
|---|---|
| Unusual access: users with the 'Subscriber' role accessing, or attempting to access, email logs | Review access logs for 'Subscriber' users requesting /wp-json/post-smtp/v1/get-details or similar REST API endpoints related to email logs |
| Unexpected password resets: multiple password reset emails sent in a short timeframe, especially if low-privileged users initiated them | Monitor email logs for a surge in password reset emails, and cross-reference it with the roles of the users who initiated the requests |
Monitoring Strategies
- Audit REST API access. Enable detailed logging for REST API requests so that it captures user roles, accessed endpoints, and timestamps. This identifies unauthorized attempts by low-privileged users to reach sensitive endpoints.
- Set up alerts for anomalous activity, so you can detect and respond to potential exploitation attempts promptly. Configure alerts for:
- Access to email logs by non-administrative users.
- Multiple password reset requests within a short period.
Reference: patchstack.com
Affected Systems and Versions
- Product: Post SMTP WordPress plugin
- Affected versions: All versions up to and including 3.2.0
- Vulnerable configurations: Any WordPress site with Post SMTP plugin version 3.2.0 or below installed and activated
Vendor Security History
WPExperts, the vendor behind Post SMTP, has fixed multiple security issues in this plugin before. Authorization bypass and stored cross-site scripting vulnerabilities were reported and patched in early 2024. The repeat issues point to a pattern of access control weaknesses, although the vendor has responded in reasonable time, usually releasing patches within weeks of disclosure.
