CVE-2026-81278
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.
Risk Assessment
Attackers can exploit missing authorization to perform unauthorized actions, potentially leading to security compromise.
Recommendation
Update Post SMTP to a patched version.
Other vulnerabilities in Post SMTP
See all- CVE-2026-48838High
Versions of Post SMTP <= 3.6.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
- CVE-2025-67563Medium
The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.
- CVE-2025-12887Medium
The Post SMTP plugin for WordPress in versions up to and including 3.6.1 is vulnerable to authorization bypass. The 'handle_gmail_oauth_redirect' function does not properly verify that a user is authorized to update OAuth tokens, allowing authenticated attackers with subscriber-level access and above to inject invalid or attacker-controlled OAuth credentials.
Original NVD description (English source)
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS