CVE-2025-11833: Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11833?
The severity of CVE-2025-11833 is considered high due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2025-11833?
To fix CVE-2025-11833, update the Post SMTP plugin to version 3.6.1 or later, which includes proper capability checks.
Who is affected by CVE-2025-11833?
Users of the Post SMTP – Complete SMTP Solution plugin for WordPress who are running versions up to and including 3.6.0 are affected by CVE-2025-11833.
What type of vulnerability is CVE-2025-11833?
CVE-2025-11833 is a security vulnerability related to unauthorized access due to a missing capability check.
When was CVE-2025-11833 disclosed?
CVE-2025-11833 was publicly disclosed as part of the security advisory process for the affected software.