CVE-2023-6875: POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6875?
CVE-2023-6875 has been rated as a medium severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2023-6875?
To fix CVE-2023-6875, update the Post SMTP Mailer plugin to version 2.8.8 or later.
Which versions are affected by CVE-2023-6875?
CVE-2023-6875 affects all versions of the Post SMTP Mailer plugin up to and including version 2.8.7.
What type of security issue is CVE-2023-6875?
CVE-2023-6875 is classified as a type juggling issue that can lead to unauthorized data access and modification.
Is user authentication impacted by CVE-2023-6875?
Yes, CVE-2023-6875 allows unauthorized users to potentially access and modify data due to inadequate authentication controls.