Cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awpexpertspost_smtpwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 13:02:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWpexperts Post Smtp: Unauthenticated API key reset and log access (CVE-2023-6875)https://feed.craftedsignal.io/briefs/2026-10-cve-2023-6875/Wed, 28 Oct 2026 13:02:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2023-6875/CVE-2023-6875 is a type juggling vulnerability in the Post Smtp WordPress plugin allowing unauthenticated attackers to perform API key resets and unauthorized access to logs.CVE-2023-6875 is a critical vulnerability affecting the Wpexperts Post Smtp WordPress plugin (version 2.8.7 and earlier). The flaw exists in the '/wp-json/post-smtp/v1/connect-app' endpoint, where a type juggling issue during the processing of the 'fcm-token' header enables an authentication bypass. Successful exploitation allows unauthenticated attackers to reset the plugin's API key and view potentially sensitive email logs.

Impact

Successful exploitation results in full unauthorized access to the plugin's configuration, including the ability to reset API credentials and exfiltrate information contained within sent email logs. The vulnerability has a CVSS 3.1 score of 9.8.

Recommendation

  • Upgrade the Wpexperts Post Smtp plugin to version 2.8.8 or later immediately to address the underlying authorization bypass.
  • Review plugin logs and configuration settings for unexpected API key changes or unauthorized log access attempts.
  • Monitor access to the WordPress REST API endpoint '/wp-json/post-smtp/v1/connect-app' for anomalous requests, particularly those containing suspicious 'fcm-token' headers.
]]>criticaladvisory