400K Websites Exposed to Account Takeovers Due to WordPress Post SMTP Plugin Flaw

A severe security vulnerability affecting over 400,000 installations of the Post SMTP WordPress plugin has been successfully patched following responsible disclosure by security researchers.

The vulnerability, tracked as CVE-2025-24000 with a CVSS score of 8.8, allowed any registered user with subscriber-level privileges to perform account takeover attacks against administrator accounts, potentially leading to complete website compromise.

The flaw stemmed from broken access control in the plugin’s REST API endpoints, which failed to properly validate user permissions beyond basic authentication checks.

Vulnerability Details and Technical Impact

The Post SMTP plugin, developed by Saad Iqbal of WPExperts, serves as an email delivery solution for WordPress websites, providing custom mailer services, email logging, and OAuth support.

The security flaw existed in versions 3.2.0 and below, specifically within the plugin’s REST API implementation.

The vulnerable code resided in the get_logs_permission function, which only verified that users were logged in without checking their privilege levels.

The critical vulnerability allowed subscriber-level users to access sensitive REST API endpoints through inadequate permission validation.

The problematic code in /post-smtp/Postman/Dashboard/includes/rest-api/v1/class-psd-rest-api.php showed that the get_logs_permission function simply returned is_user_logged_in() without additional capability checks.

This enabled unauthorized users to perform various actions, including viewing email statistics, resending emails, and most dangerously, accessing detailed email logs containing complete message bodies.

The most severe exploitation vector involved intercepting password reset emails sent to administrator accounts.

By accessing the email logs through the /get-details REST endpoint, malicious subscribers could capture reset tokens and compromise high-privileged accounts, escalating their access from subscriber to administrator level.

Exploitation Method and Code Analysis

The vulnerability manifested through multiple REST API endpoints that relied solely on the flawed permission callback.

The registration code for these endpoints showed the security gap:

phpregister_rest_route(
    $this->namespace,
    '/get-details',
    array(
        'methods' => WP_REST_Server::READABLE,
        'callback' => array( $this, 'get_details' ),
        'permission_callback' => array( $this, 'get_logs_permission' )
    )
);

The vulnerable get_logs_permission The function demonstrated the core issue:

phppublic function get_logs_permission() {
    return is_user_logged_in();
}

This implementation failed to incorporate WordPress’s capability system, which typically requires functions like current_user_can('manage_options') for administrative features.

Attackers could exploit this by making authenticated requests to sensitive endpoints, bypassing intended access controls entirely.

Remediation and Security Recommendations

The vulnerability was patched in Post SMTP version 3.3.0 through enhanced permission validation in the get_logs_permission function.

The fix incorporated proper capability checks, ensuring only users with manage_options Privileged can access administrative API endpoints.

The timeline showed responsible disclosure practices, with the initial report made on May 23, 2025, followed by vendor coordination and patch release on June 11, 2025.

Security researchers recommend implementing defense-in-depth strategies for WordPress plugin development, including proper capability validation, input sanitization, and regular security audits.

The incident highlights the importance of following WordPress security best practices, particularly when handling sensitive data like email communications.

Website administrators should immediately update to version 3.3.0 or later and review user privileges to ensure appropriate access controls are maintained across their WordPress installations.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates