- Description
- The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
- Source
- security@wordfence.com
- NVD status
- Deferred
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- security@wordfence.com
- CWE-862
- Hype score
- Not currently trending
🚨 [HIGH] Active exploitation detected: CVE-2025-11833 Exploit in the wild confirmed for CVE-2025-11833 (CVSS null). The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugi... 🔗 https://t.co/RZBhpWnHFz #ZeroDay #ExploitInWild #CyberSe
@ctiwatchcloud
14 Apr 2026
135 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-11833 - critical 🚨 Post SMTP <= 3.6.0 - Email Log Disclosure > Post SMTP WordPress plugin <= 3.6.0 contains an unauthorized data access vulnerabilit... 👾 https://t.co/dGbWexdBXZ @pdnuclei #NucleiTemplates #cve
@pdnuclei_bot
29 Nov 2025
143 Impressions
1 Retweet
0 Likes
1 Bookmark
0 Replies
0 Quotes
⚠️Vulnerabilidad en complemento de WordPress ❗CVE-2025-11833 ➡️Más info: https://t.co/pIxybQ53dz https://t.co/P92kncj1g0
@CERTpy
12 Nov 2025
102 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Critical WordPress plugin vulnerability – CVE-2025-11833 • Affects Post SMTP plugin ≤ v3.6.0 • Unauthenticated access → email logs exposed (password reset links!) • CVSS 9.8 (Critical)
@bountyayush
7 Nov 2025
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨Una grave vulnerabilidad en el plugin Post SMTP afecta a 400.000 sitios de WordPress Los atacantes ya están explotando una vulnerabilidad que les permite comprometer completamente una cuenta y el sitio web con fines maliciosos ⚠️ CVE-2025-11833 https://t.co/xwuL7zy4mH
@elhackernet
6 Nov 2025
2321 Impressions
5 Retweets
14 Likes
4 Bookmarks
0 Replies
0 Quotes
CVE-2025-11833 ثغرة أمنية باسم مرتبطة بإضافة Post SMTP الخاصة بووردبريس، وتحديدًا تُتيح الوصول إلى سجلات البريد الإلكتروني (Email Logs) بدون تسجيل دخول أو صلاحيات (Unauthent
@1m5t1
6 Nov 2025
101 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔒 Alerta de seguridad crítica en WordPress. Investigadores han identificado que actores maliciosos están explotando activamente la vulnerabilidad CVE-2025-11833 en el plugin Post SMTP, instalado en más de 400.000 sitios. https://t.co/7D8VjsqUQu #ciberseguridad #CVE_2025_118
@henryraul
6 Nov 2025
104 Impressions
3 Retweets
2 Likes
2 Bookmarks
1 Reply
0 Quotes
Vulnerabilidade crítica no plugin Post SMTP permite roubo de contas admin: Exploit CVE-2025-11833 afeta mais de 400 mil sites WordPress, dando controle total a hackers; atualização para a versão 3.6.1 é urgente para evitar invasões. https://t.co/nLh05BQUfP
@caveiratech
5 Nov 2025
41 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
مهاجمان سایبری بهطور فعال از آسیبپذیری بحرانی در افزونه Post SMTP که بر روی بیش از ۴۰۰ هزار سایت وردپرس نصب شده است سوءاستفاده میکنند تا با ربودن حسابها
@Teeegra
5 Nov 2025
856 Impressions
0 Retweets
10 Likes
4 Bookmarks
0 Replies
0 Quotes
🔴 CVE-2025-11833 Post SMTP: 210K WordPress Sites Exposed to Admin Takeover Post SMTP plugin has a critical authorization bypass (CVSS 9.8) letting unauthenticated attackers harvest password reset links from email logs. What's brutal: CVE-2025-11833 affects 400,000+ WordPre
@the_c_protocol
5 Nov 2025
1 Impression
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚡️ Cybersecurity Developments in the Last 12 Hours ⚡️ 🚨 A critical vulnerability in the Post SMTP WordPress plugin (CVE-2025-11833) affects over 400,000 sites and can enable admin account hijacks unless updated to 3.6.1 or the plugin is disabled. 👾 Hundreds of mal
@greytech_ltd
5 Nov 2025
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
WordPress Post SMTP脆弱性で管理者乗っ取り被害、CVE-2025-11833 https://t.co/rmz5gWY3Cn #Security #セキュリティー #ニュース
@SecureShield_
5 Nov 2025
39 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
400.000 llocs de WordPress són vulnerables a un bug del plugin Post SMTP. Els atacants poden arribar a restablir les contrasenyes dels comptes d’administrador. Registrada com a CVE-2025-11833, la vilnerabilitat té una puntuació de 9,8/10. https://t.co/U0D9cmlesh
@lalgorisme
5 Nov 2025
230 Impressions
1 Retweet
2 Likes
0 Bookmarks
0 Replies
0 Quotes
A critical flaw (CVE-2025-11833) in the Post SMTP WordPress plugin affects over 400,000 sites, enabling admin account hijacking. Patch applied in version 3.6.1 fixes the issue. #WordPressSecurity #PluginVulnerability #USA https://t.co/8jRlrxywZM
@TweetThreatNews
5 Nov 2025
21 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
برای پلاگین Post SMTP در Wordpress آسیب پذیری با کد شناسایی CVE-2025-11833 منتشر شده است که باعث دسترسی هکرها به لاگ ایمیل ها می شود. 400 هزار وب سایت در خطر این تهدید می باش
@EthicalSafe
4 Nov 2025
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Just opened PR for CVE-2025-11833 detection in Post SMTP! Check it out: https://t.co/oeWye6c6zE #nuclei #CVE2025 #WordPressSecurity @projectdiscovery
@Lau_6669
4 Nov 2025
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
400,000 Sites at Risk: You MUST Update NOW to Block Unauthenticated Account Takeover (CVE-2025-11833) Read the full report on - https://t.co/rzTI1Sqy5Q https://t.co/RcEs0vKOOS
@cyberbivash
1 Nov 2025
1 Impression
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
40万サイト以上が使用するWordPressのPost SMTPプラグインに重大(Critical)な脆弱性。CVE-2025-11833はCVSSスコア9.8で、プラグインのメールログがだれでも読み取れるもの。パスワードリセットリンクも読み取れる。Wordfen
@__kokumoto
1 Nov 2025
1871 Impressions
5 Retweets
15 Likes
4 Bookmarks
0 Replies
2 Quotes
[CVE-2025-11833: CRITICAL] WordPress Post SMTP plugin up to version 3.6.0 is at risk of data breaches. An exploit allows attackers to intercept and read sensitive emails, posing a severe security threat.#cve,CVE-2025-11833,#cybersecurity https://t.co/9WByetgdez https://t.co/wFLmi
@CveFindCom
1 Nov 2025
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-11833 Post SMTP WordPress Plugin Unauthenticated Arbitrary Email Log Disclosure https://t.co/pf8xj2jexy
@VulmonFeeds
1 Nov 2025
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CRITICAL: CVE-2025-11833 in Post SMTP plugin exposes WordPress email logs to unauthenticated attackers — risking password reset hijacks & account takeover. Patch pending! 🔒 Details: https://t.co/85iRB3QPXs #... https://t.co/KJRTgwvth2
@offseq
1 Nov 2025
141 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
**CVE-2025-11833** pertains to the **Post SMTP** plugin for WordPress, which is utilized for managing SMTP email functionalities, including logs, alerts, backups, and mobile app integrations. The vulnerability arises from an **insufficient capability check** in the plugin's
@CveTodo
1 Nov 2025
22 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-11833: Post SMTP WordPress plugin ≤3.6.0 lets unauthenticated visitors read stored emails, including password reset links, leading to account takeover. Update to 3.6.1 now! Advisory ➡️ https://t.co/NSoaRxM1yH #WordPress #infosec #AppSec
@VolerionSec
1 Nov 2025
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-11833 The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing … https://t.co/KZi0rkz49J
@CVEnew
1 Nov 2025
382 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes