CVE-2023-6875
First published: Thu Jan 11 2024(Updated: )
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Post SMTP | <=2.8.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve
- https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60
- https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2Ftrunk
- http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html
Frequently Asked Questions
What is the severity of CVE-2023-6875?
CVE-2023-6875 has been rated as a medium severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2023-6875?
To fix CVE-2023-6875, update the Post SMTP Mailer plugin to version 2.8.8 or later.
Which versions are affected by CVE-2023-6875?
CVE-2023-6875 affects all versions of the Post SMTP Mailer plugin up to and including version 2.8.7.
What type of security issue is CVE-2023-6875?
CVE-2023-6875 is classified as a type juggling issue that can lead to unauthorized data access and modification.
Is user authentication impacted by CVE-2023-6875?
Yes, CVE-2023-6875 allows unauthorized users to potentially access and modify data due to inadequate authentication controls.
- agent/first-publish-date
- agent/severity
- agent/author
- agent/description
- agent/weakness
- agent/type
- agent/references
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/trending
- agent/event
- agent/tags
- agent/source
- vendor/wpexperts
- canonical/post smtp
- version/post smtp/2.8.7