CVE-2025-12887
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Post SMTP plugin for WordPress in versions up to and including 3.6.1 is vulnerable to authorization bypass. The 'handle_gmail_oauth_redirect' function does not properly verify that a user is authorized to update OAuth tokens, allowing authenticated attackers with subscriber-level access and above to inject invalid or attacker-controlled OAuth credentials.
Risk Assessment
An attacker could hijack or corrupt the outgoing mail configuration, potentially sending messages on behalf of the organization or exposing credentials. This can compromise the integrity of email communications and trust in the system.
Recommendation
Update the Post SMTP plugin to a version later than 3.6.1 as soon as a fix is available. Until then, consider restricting access to OAuth functionality or disabling the plugin.
Other vulnerabilities in Post SMTP
See all- CVE-2026-81278Medium
Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.
- CVE-2026-48838High
Versions of Post SMTP <= 3.6.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
- CVE-2025-67563Medium
The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.
Original NVD description (English source)
The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS