The Post SMTP plugin contains a missing capability check in its constructor, allowing unauthenticated users to read email logs recorded by the plugin. This flaw enables attackers to obtain logged outbound emails – including password‑reset communications containing reset links – without authentication, which can lead to account takeover.

This issue affects all releases of the WordPress Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin up to and including version 3.6.0.

The missing authorization check permits unauthenticated access to the plugin’s email logs; an attacker can request the log endpoint, retrieve sensitive email content such as password‑reset tokens, and subsequently perform account takeover of any target user. The high CVSS score of 9.8 and EPSS of 16% indicate a high risk and a moderate likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog, so no coordinated response is currently in place.