CVE-2025-22800 MEDIUM

CVE-2025-22800: WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability

Vendor Saad Iqbal
Product Post SMTP
Weakness CWE-862 · Missing authorization
Published January 13, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.

Explanation of Vulnerability in Simple Terms

02Summary

Post SMTP versions up to 2.9.11 lack proper authorization checks, allowing authenticated users with low privileges to disrupt email delivery. An attacker with a basic user account can trigger a denial-of-service condition affecting the plugin's availability. No code execution or data exposure occurs. Update to a version newer than 2.9.11.

What an attacker can do

03Attacker Capabilities

Disrupt email delivery by triggering a denial-of-service condition in the plugin.

Potential impact on your site

04Site Impact

Email functionality may become unavailable if a low-privilege user exploits this flaw.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no special interaction required.

Key dates

06Disclosure timeline

January 13, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57730 WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability CVE-2026-12133 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action CVE-2026-27409 WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification CVE-2026-12902 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions