Description
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Published: 2023-07-17
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-43860 The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
History

Wed, 04 Jun 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Wpexperts post Smtp
CPEs cpe:2.3:a:wpexperts:post_smtp_mailer:*:*:*:*:*:wordpress:*:* cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*
Vendors & Products Wpexperts post Smtp Mailer
Wpexperts post Smtp

Thu, 07 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-352
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Wpexperts Post Smtp
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2024-11-07T14:18:23.148Z

Reserved: 2023-06-09T08:24:57.044Z

Link: CVE-2023-3179

cve-icon Vulnrichment

Updated: 2024-08-02T06:48:08.071Z

cve-icon NVD

Status : Modified

Published: 2023-07-17T14:15:10.843

Modified: 2025-06-04T15:05:06.540

Link: CVE-2023-3179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses