The Post SMTP plugin for WordPress allows any authenticated user with Subscriber-level access or higher to overwrite the site's Office 365 OAuth mail configuration. This is caused by the handle_office365_oauth_redirect() function being hooked to admin_init without a current_user_can() check or nonce verification. As a result, attackers can provide a crafted URL that writes new access token, refresh token, and user email values into the plugin's configuration. The vulnerability is an access‑control failure (CWE‑862) that enables unauthorized modification of critical email settings and could lead to an administrator believing an attacker‑controlled Azure app is legitimate. This may allow the attacker to redirect mail traffic or compromise the site’s email delivery based on the overwritten configuration.

The vulnerability affects the WordPress plugin saadiqbal:Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App. All supported plugin releases up to and including version 3.8.0 are vulnerable. Versions 3.8.1 and newer contain the fix and are not affected.

The CVSS v3.1 score is 5.3, indicating a medium severity impact. No EPSS score is available, and the weakness is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit requires a valid authenticated WordPress session with a role of Subscriber or higher, and the attacker must construct a URL that triggers the admin_init hook. Because it only affects users that already have some level of access, the risk is limited to compromised or low‑privilege accounts rather than unauthenticated public exposure. Nonetheless, the potential for an attacker to disguise themselves as an administrator and reconfigure Office 365 settings means that sites with active Office 365 integration should treat it as a moderate positive risk until patched.