POST SMTP PLUGIN FLAW EXPOSES 200K WORDPRESS SITES TO HIJACKING ATTACKS

Summary from the TLDR InfoSec newsletter

A critical security vulnerability (CVE-2025-24000) in the Post SMTP WordPress plugin allows low-privileged users to access email logs and hijack administrator accounts by intercepting password reset emails. The flaw affects all versions up to 3.2.0 and stems from broken access controls that only checked if users were logged in without verifying their permission levels. Despite a fix being released in version 3.3.0 on June 11, over 200,000 WordPress sites remain vulnerable, as more than half of users haven't updated their plugin.