Threat actors are now exploiting a critical remote attack vulnerability in the popular Post SMTP WordPress plug-in, used by over 400,000 websites for email delivery and logging.
Discovered through Wordfence’s bug bounty program and tracked as CVE-2025-11833 (CVSS 9.8), the flaw allows unauthenticated attackers to reset passwords for any user — including site administrators. Once exploited, the attacker can gain full control of the site, upload backdoors, or deface content.
“This vulnerability makes it possible for unauthenticated threat actors to easily take over websites by resetting the password of any user,” said Wordfence researcher István Márton.
Timeline
- Oct 11: Flaw reported via Wordfence’s bounty program
- Oct 29: Patch released — version 3.6.1
- Nov 1: Active exploitation observed (4,500+ attacks blocked)
The vulnerability stems from missing capability checks in the plug-in’s __construct function, which allows attackers to access and read logged emails — including password reset emails. Once the reset key is extracted, attackers can change admin credentials and compromise the entire website.
Active Campaigns
Wordfence has already observed automated attack activity targeting vulnerable sites and predicts a large-scale campaign in the coming days. Exploited websites can be used to host phishing pages, inject malicious scripts, or distribute malware.
Recommendations
✅ Update Post SMTP to v3.6.1 immediately
✅ Enable and monitor your Wordfence or other WAF protections
✅ Review admin and editor accounts for unauthorized changes
✅ Scan for malicious uploads or modified PHP files
Why It Matters
WordPress plug-ins remain a major attack vector due to their large install base and inconsistent patch adoption. This vulnerability shows how a single flaw in a high-use plug-in can expose thousands of websites to takeover.
Alcaeus Services recommends adopting automated patch management, WAF protection, and credential rotation policies for all WordPress environments.
