This vulnerability in the Saad Iqbal Post SMTP plugin allows an attacker to bypass normal authentication by using an alternate path or channel. The result is an account takeover, where the attacker can log in as any user, potentially assuming administrative privileges. The weakness is a classic Authentication Bypass (CWE‑288) that directly undermines the integrity of user access controls.

WordPress sites that have the Saad Iqbal Post SMTP plugin installed, any version up to and including 3.2.0, are affected. This includes installations from the base 3.2.0 release backward. Site owners who rely on the original Post SMTP plugin for email delivery must verify the installed version and apply updates accordingly.

Classified as a high‑severity flaw with a CVSS score of 8.8, this issue is unlikely to be widely exploited currently, as indicated by an EPSS score of less than 1% and the absence of a listing in CISA’s KEV catalog. Nonetheless, because the vulnerability permits direct login impersonation, the exploitation would be straightforward for a skilled attacker—particularly if the WordPress site is exposed over the web. The attack vector would most likely involve sending crafted requests to the plugin’s authentication endpoints, requiring only network access to the site.