Authentication bypass / privilege escalation in Post SMTP WordPress plugin email log REST API
CVE-2025-24000 affects the Post SMTP WordPress plugin through version 3.2.0. The issue is an authorization flaw in the plugin’s REST API permission handling for email log access, specifically described in reporting as the get_logs_permission function. The vulnerable logic checked only whether the requester was authenticated (for example, via a logged-in WordPress session) and did not verify that the user had the required administrative role or capabilities. As a result, low-privileged authenticated users, including Subscriber-level accounts, could access administrator-intended REST API endpoints such as the email log retrieval functionality. Because Post SMTP logs email content, the exposed data could include sensitive messages such as password reset emails for privileged accounts, creating a practical path from low-privilege access to full site compromise.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit for CVE-2025-24000 affecting the Post SMTP WordPress plugin up to version 3.2.0. The repo contains only two files: a README describing the vulnerability, exploitation flow, requirements, and examples; and a single executable Python script, exploit_cve_2025_24000.py, which is the main entry point. The exploit is not part of a larger framework. The script automates a full authenticated privilege-escalation chain over web endpoints. It logs into WordPress as a low-privilege user through wp-login.php, accesses /wp-admin/ to scrape a WordPress REST nonce from page content, triggers a password reset for a chosen administrator account via wp-login.php?action=lostpassword, then abuses vulnerable Post SMTP REST API endpoints /wp-json/psd/v1/get-logs and /wp-json/psd/v1/get-details?id=<id>&type=show_view to read email logs that should be restricted to administrators. It searches returned log content for a password reset URL containing action=rp and outputs the recovered reset link, enabling takeover of the administrator account. Code structure is straightforward: helper functions implement login, nonce extraction, password reset triggering, log retrieval, email ID extraction, detailed log retrieval, and regex-based reset-link extraction. If log IDs are not present in the initial response, the script falls back to brute-forcing email IDs 1 through 20. The exploit uses Python requests with TLS verification disabled and relies on an authenticated session plus the X-WP-Nonce header for REST access. Overall, this is an operational exploit that provides practical account takeover capability rather than mere detection.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in the Post SMTP WordPress plugin reported to enable unauthorized access to email logs.
A prior authorization vulnerability in the Post SMTP plugin that allowed authenticated users to access email logs.
An authentication/authorization flaw in the Post SMTP WordPress plugin that allows low-privileged authenticated users to access admin-only REST API email logs, potentially intercept password reset emails, and escalate privileges to full administrative control.
A high-risk vulnerability in Post SMTP. Details on exploitation or impact are not provided in the content.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.