CVE-2023-6875

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.

• CWE-639
• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60Issue Tracking
• https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2FtrunkProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cveThird Party Advisory
• http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60Issue Tracking
• https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2FtrunkProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cveThird Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6869A `<dialog>` element could have been manipulated to paint…6.5
• CVE-2023-6870Applications which spawn a Toast notification in a backgroun…4.3
• CVE-2023-6871Under certain conditions, Firefox did not display a warning …4.3
• CVE-2023-6872Browser tab titles were being leaked by GNOME to system logs…6.5
• CVE-2023-6873Memory safety bugs present in Firefox 120. Some of these bug…8.8
• CVE-2023-6874Prior to v7.4.0, Ember ZNet is vulnerable to a denial of ser…7.5
• CVE-2023-6876The Clever Fox – One Click Website Importer by Nayra Themes …5.4
• CVE-2023-6877The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…5.4
• CVE-2023-6878The Slick Social Share Buttons plugin for WordPress is vulne…6.5
• CVE-2023-6879Increasing the resolution of video frames, while performing …9.8
• CVE-2023-6880The Visual Composer Website Builder, Landing Page Builder, C…5.4
• CVE-2023-6881Possible buffer overflow in is_mount_point9.8