CVE-2025-12887
BaseFortify
Publication date: 2025-12-03
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | post_smtp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Post SMTP WordPress plugin (up to version 3.6.1) allows authenticated users with subscriber-level access or higher to bypass authorization checks in the 'handle_gmail_oauth_redirect' function. Because the plugin does not properly verify user authorization when updating OAuth tokens, attackers can inject invalid or attacker-controlled OAuth credentials. The issue stems from insufficient input sanitization, missing authorization checks, and lack of CSRF protection in the OAuth token update process. [1]
How can this vulnerability impact me? :
An attacker with at least subscriber-level access could exploit this vulnerability to inject malicious OAuth credentials into the plugin. This could lead to unauthorized access or manipulation of email sending capabilities through the plugin, potentially allowing attackers to send emails on behalf of the site or disrupt email functionality. It may also expose the site to further attacks due to improper authorization and input handling. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking if the Post SMTP WordPress plugin version is 3.6.1 or earlier, as these versions are vulnerable. You can run commands to identify the plugin version installed, for example, by using WP-CLI: `wp plugin list --format=json | jq '.[] | select(.name=="post-smtp") | .version'`. Additionally, monitoring for unauthorized OAuth token update attempts or suspicious OAuth redirect requests in your web server logs may help detect exploitation attempts. However, no specific detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Post SMTP WordPress plugin to version 3.6.2 or later, which includes fixes for this vulnerability. The update adds proper authorization checks restricting OAuth token updates to users with the 'manage_options' capability, enforces nonce verification to prevent CSRF attacks, and improves input sanitization. Applying this update will prevent unauthorized OAuth token injection by authenticated users with subscriber-level access and above. [1]