CVE-2025-11833

This vulnerability lets an attacker see internal email “receipts” stored by the Post SMTP plugin. Those logs can include password reset emails, which contain the special reset links—so an attacker may use them to take over user accounts.

This matters if you run a WordPress site with the Post SMTP plugin (Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App) at version 3.6.0 or earlier.
It’s a network risk without any login, and it’s reachable in the default configuration.
The danger is highest when your site has password reset emails stored in Post SMTP logs (so an attacker can reuse the reset links).

This is RED because the issue allows unauthenticated attackers to steal sensitive email logs, including password reset links, which can directly lead to account takeover. The risk is reachable by outsiders and does not require login.
Treat this as urgent to fix immediately, especially if your site processes password resets or stores them in Post SMTP logs.

1. Confirm exposure

   • Identify the exact plugin name used on your WordPress site: “post smtp” (Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App).
   • Check the installed plugin version.
   • If it is 3.6.0 or earlier, assume the site is exposed because the missing authorization allows log disclosure without authentication over the network.

2. Assess whether sensitive data is present

   • In the Post SMTP setup/logs, look for evidence that the plugin stored emails related to password resets.
   • Review your recent account activity: any unexpected password reset requests or new logins since the time window when logs may have been collected.

3. Fix (upgrade)

   • Upgrade Post SMTP to a version that includes the vendor authorization fix referenced by the changeset/patch described by the vendor guidance (the fix is linked via changeset 3386160 and PostmanEmailLogs.php in the vendor references).
   • After upgrading, confirm the plugin update completed successfully and that the version is no longer 3.6.0 or earlier.

4. Contain and recover

   • If you suspect any password reset links were exposed or used: force a password reset for affected accounts and invalidate sessions/tokens where your WordPress setup allows it.
   • Rotate credentials for any administrators/users whose accounts might have been targeted.
   • Consider reviewing how long logs are retained and who can access them internally.

5. Monitor

   • Watch for unusual login patterns and repeated password reset requests.
   • Keep an eye on Post SMTP logs and access attempts to detect abnormal retrieval behavior.

6. CISA due date

   • No CISA KEV entry was provided in the findings, so no specific KEV-driven due date is known from this dataset.

Severity and why it matters: The finding indicates a critical, unauthenticated information disclosure that can directly enable account takeover when password reset links are included in Post SMTP email logs.

Mechanism: A missing permission/capability check on the plugin’s __construct function allows attackers to read arbitrary logged emails through Post SMTP without logging in. Because password reset emails can contain usable reset links, the attacker can hijack user accounts.

Attack vector and reachability: Network-reachable in default configuration; authentication is not required; user interaction is not required.

Exploitation status: No CISA KEV listing was provided, and the exploit section contains only detection-template information (no explicit “in-the-wild exploitation” claim in the provided findings). However, the traffic-light verdict is RED, and the risk is severe given the direct account-takeover path.

EPSS: A predicted likelihood is provided in the findings (rising trend), but per instructions the public-facing blocks must not rely on EPSS for certainty when exploitation is confirmed via KEV/news; KEV is not listed here.

CWE: CWE-862 (Missing Authorization).