Greater than 200,000 WordPress web sites are utilizing a susceptible model of the Publish SMTP plugin that enables hackers to take management of the administrator account.
Publish SMTP is a well-liked electronic mail supply plugin for WordPress that counts greater than 400,000 energetic installations. It’s marketed as a alternative of the default ‘wp_mail()’ perform that’s extra dependable and feature-rich.
On Might 23, a safety researcher reported the vulnerability to WordPress safety agency PatchStack. The flaw is now recognized as CVE-2025-24000 and acquired a medium severity rating of 8.8.
The safety situation impacts all variations of Publish SMTP as much as 3.2.0 and is because of a damaged entry management mechanism within the plugin’s REST API endpoints, which solely verified if a consumer was logged in, with out checking their permission stage.
Which means low-privileged customers, similar to Subscribers, might entry electronic mail logs containing full electronic mail content material.
On susceptible websites, a subscriber might provoke a password reset for an Administrator account, intercept the reset electronic mail through the logs, and achieve management of the account.
The susceptible code
Supply: PatchStack
The plugin’s developer, Saad Iqbal, was knowledgeable in regards to the flaw and responded with a repair for Patchstack to overview on Might 26.
The answer was to include extra privilege checks within the ‘get_logs_permission’ perform that might validate a consumer’s permissions earlier than giving entry to delicate API calls.
The repair was integrated into Publish SMTP model 3.3.0, which was printed on June 11.
Obtain statistics on WordPress.org present that lower than half of the plugin’s consumer base (48.5%) has up to date to model 3.3. Which means greater than 200,000 web sites are susceptible to CVE-2025-24000.
A notable 24.2%, comparable to 96,800 websites, nonetheless run Publish SMTP variations from the two.x department, which is susceptible to extra safety flaws, leaving them open to assaults.
CISOs know that getting board buy-in begins with a transparent, strategic view of how cloud safety drives enterprise worth.
This free, editable board report deck helps safety leaders current threat, affect, and priorities in clear enterprise phrases. Flip safety updates into significant conversations and quicker decision-making within the boardroom.
