Executive Summary

This vulnerability in the Post SMTP WordPress plugin (up to version 3.6.1) allows authenticated users with subscriber-level access or higher to bypass authorization checks in the 'handle_gmail_oauth_redirect' function. Because the plugin does not properly verify user authorization when updating OAuth tokens, attackers can inject invalid or attacker-controlled OAuth credentials. The issue stems from insufficient input sanitization, missing authorization checks, and lack of CSRF protection in the OAuth token update process. [1]

Useful 0 Not Useful 0

Impact Analysis

An attacker with at least subscriber-level access could exploit this vulnerability to inject malicious OAuth credentials into the plugin. This could lead to unauthorized access or manipulation of email sending capabilities through the plugin, potentially allowing attackers to send emails on behalf of the site or disrupt email functionality. It may also expose the site to further attacks due to improper authorization and input handling. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can involve checking if the Post SMTP WordPress plugin version is 3.6.1 or earlier, as these versions are vulnerable. You can run commands to identify the plugin version installed, for example, by using WP-CLI: `wp plugin list --format=json | jq '.[] | select(.name=="post-smtp") | .version'`. Additionally, monitoring for unauthorized OAuth token update attempts or suspicious OAuth redirect requests in your web server logs may help detect exploitation attempts. However, no specific detection commands are provided in the resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Post SMTP WordPress plugin to version 3.6.2 or later, which includes fixes for this vulnerability. The update adds proper authorization checks restricting OAuth token updates to users with the 'manage_options' capability, enforces nonce verification to prevent CSRF attacks, and improves input sanitization. Applying this update will prevent unauthorized OAuth token injection by authenticated users with subscriber-level access and above. [1]

Useful 0 Not Useful 0