Skip to content
Threat Feed
Subscribe
critical advisory

Wpexperts Post Smtp: Unauthenticated API key reset and log access (CVE-2023-6875)

CVE-2023-6875 is a type juggling vulnerability in the Post Smtp WordPress plugin allowing unauthenticated attackers to perform API key resets and unauthorized access to logs.

CVE search metadata

CVE search record: CVE-2023-6875. Severity: critical. CVSS: 9.8. EPSS: 90.34%. KEV: no. Product: Post Smtp (<= 2.8.7). Brief: Wpexperts Post Smtp: Unauthenticated API key reset and log access (CVE-2023-6875). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2023-6875/

Triage facts

Revision 1
Applicability
Post Smtp (<= 2.8.7)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 28, 13:02 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A4Likely

CVE-2023-6875 is a critical vulnerability affecting the Wpexperts Post Smtp WordPress plugin (version 2.8.7 and earlier). The flaw exists in the '/wp-json/post-smtp/v1/connect-app' endpoint, where a type juggling issue during the processing of the 'fcm-token' header enables an authentication bypass. Successful exploitation allows unauthenticated attackers to reset the plugin's API key and view potentially sensitive email logs.

Impact

Successful exploitation results in full unauthorized access to the plugin's configuration, including the ability to reset API credentials and exfiltrate information contained within sent email logs. The vulnerability has a CVSS 3.1 score of 9.8.

Recommendation

  • Upgrade the Wpexperts Post Smtp plugin to version 2.8.8 or later immediately to address the underlying authorization bypass.
  • Review plugin logs and configuration settings for unexpected API key changes or unauthorized log access attempts.
  • Monitor access to the WordPress REST API endpoint '/wp-json/post-smtp/v1/connect-app' for anomalous requests, particularly those containing suspicious 'fcm-token' headers.

Immediate actions

Patch Post Smtp plugin to version 2.8.8 or later.

IT Operations 24h

Threat Hunt

Identify unexpected POST requests to /wp-json/post-smtp/v1/connect-app from unauthorized or external IPs.

T1190 high high confidence hunt now

Data: Web server access logs

Enrichment needed

  • Internal web access logs for /wp-json/post-smtp/v1/connect-app (SOC) Determine if any historical exploitation attempts occurred.

Mitigations

Upgrade Post Smtp to 2.8.8+

immediate IT Operations

CVE-2023-6875

Detection coverage 1

Detect CVE-2023-6875 Exploitation Attempt

high

Detects exploitation attempts against the Post Smtp connect-app endpoint by monitoring for requests with the fcm-token header indicative of the vulnerability.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →