CVE-2023-6875

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6875
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6875.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6875
Published
2024-01-11T08:33:06.214Z
Modified
2026-07-15T01:49:05.852045444Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
Details

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.

Database specific 
{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-639"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.8.7"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6875.json"
}
References

Affected packages

Git / github.com/wpexpertsio/post-smtp

Affected ranges

Type
GIT
Repo
https://github.com/wpexpertsio/post-smtp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
437956ad80f774c66350ad620f75262cd50ebc34
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.7"
        }
    ]
}

Affected versions

2.*
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.25-beta.1
2.0.26
2.0.27
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1
2.1-beta.1
2.1.1
2.1.1.1
2.1.2
2.1.2-beta-1
2.1.2-rc.1
2.1.2-rc.2
2.1.4
2.1.4-beta.1
2.1.4-rc.1
2.1.4-rc.2
2.1.6
2.1.7
2.1.8
2.2
2.2-beta.2
2.2.1
2.3
2.3.1
2.4
2.4-beta.1
2.4.1
2.4.2
2.4.2-beta.2
2.4.3
2.5-beta.1
2.5-rc.1
2.5-rc.2
2.5-rc.3
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9-beta.1
2.5.9.3
2.5.9.4
2.6.0
2.7.0
2.7.2
2.8.3
2.8.4
2.8.5
2.8.7
v.*
v.1.9.0
v.1.9.1
v.1.9.2
v1.*
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6875.json"