CVE-2023-6875 is a critical vulnerability affecting the POST SMTP Mailer plugin for WordPress, versions up to and including 2.8.7. This flaw, a type juggling issue on the connect-app REST endpoint, allows unauthenticated attackers to reset the API key and access sensitive logs, including password reset emails, leading to full site takeover. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability poses a severe risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While not yet listed on CISA's KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and it has garnered significant community discussion and media coverage, indicating a high likelihood of active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.8.7CPE matchmatch criteria | cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.