CVE-2022-2352

CVE-2022-2352: Post SMTP < 2.1.7 - Admin+ Blind SSRF

Vendor Unknown

Product Post SMTP Mailer/Email Log

Weakness CWE-918 · SSRF

Published September 26, 2022

Last update May 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.

Key dates

02Disclosure timeline

September 26, 2022 CVE published

May 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2352 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html

Related vulnerabilities

04Related CVE

CVE-2026-34753 vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` CVE-2025-14438 Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2022-31132 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" CVE-2026-48818 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-7150 dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery