CVE-2026-2559
Unauthorized Data Modification in Post SMTP WordPress Plugin
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| post_smtp | post_smtp | to 3.8.0 (inc) |
| wp_mail_smtp | post_smtp | to 3.8.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Post SMTP plugin for WordPress has a vulnerability in the function handle_office365_oauth_redirect() present in all versions up to 3.8.0. This function lacks proper capability checks and nonce verification, allowing authenticated users with Subscriber-level access or higher to modify the site's Office 365 OAuth mail configuration by using a specially crafted URL.
Because the function is hooked to admin_init without verifying user permissions, attackers can overwrite sensitive configuration options such as access tokens, refresh tokens, and user email related to Microsoft365 SMTP setup in the Pro version of the plugin.
How can this vulnerability impact me? :
This vulnerability allows an attacker with low-level authenticated access to overwrite the Office 365 OAuth mail configuration of the site. This could lead to an administrator unknowingly connecting the plugin to an attacker-controlled Azure application during configuration after upgrading to the Pro version.
Such unauthorized modification can compromise the integrity of the mail system, potentially allowing the attacker to intercept or manipulate emails sent via the plugin.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know