CVE-2023-6875

What it actually does

The flaw is an unauthenticated authorization bypass in the POST SMTP Mailer WordPress plugin REST API, caused by weak type handling on the connect-app endpoint. An attacker can send a crafted request that abuses PHP type juggling to reset or obtain the API key used by the plugin’s mobile/app integration. With that key, the attacker can access sensitive mailer functions and email logs, including password-reset messages, enabling account takeover and modification of plugin-managed data. The described vulnerable plugin versions are up to and including 2.8.7.

Why it matters to the business

Successful exploitation can turn a public WordPress site into an account-takeover entry point: attackers may read password-reset emails, take over administrator accounts, alter mail settings, deploy malicious plugins or web shells, steal user data, send phishing emails, or use the site as an initial foothold for broader intrusion. The EPSS score is very high and exploit maturity is weaponized, with reported association to Black Basta ransomware operations, so exposed sites should be treated as urgent even though this is not currently listed in CISA KEV. If the affected component is widely deployed across many websites, compromise can scale quickly across brands, customer portals, and content-management infrastructure.

How an attack unfolds

An attacker scans for WordPress sites running the vulnerable POST SMTP Mailer plugin. They send an unauthenticated crafted request to the plugin’s connect-app REST endpoint, abusing the type-juggling issue to reset or obtain the plugin API key. The attacker then uses that key to call plugin API functions and retrieve stored email logs. If password-reset emails are present, or if the attacker triggers a new reset for an administrator account and reads the resulting message from the logs, they can take over the WordPress account. After gaining administrative access, the attacker may create persistence, install malicious plugins or themes, modify site content, harvest additional credentials, send phishing mail, or use the web server as a staging point for ransomware operations such as those associated with Black Basta.

How to fix it

Upgrade POST SMTP Mailer to a fixed release newer than 2.8.7, preferably the latest version available from the WordPress plugin repository or vendor. If using distribution package tracking that identifies linux on Debian 13 as affected, apply the provided fixed package version 6.5.10-1 where applicable, but validate that this package metadata actually maps to the deployed vulnerable component. After patching, rotate the POST SMTP Mailer API key, SMTP credentials, WordPress administrator passwords, and any credentials that may have appeared in mail logs. Invalidate active sessions and outstanding password-reset links. Clear or restrict access to historical email logs if they contain sensitive content. If the mobile/app API feature is not required, disable it or restrict access to the relevant REST routes with WAF rules, reverse-proxy controls, or authentication. Review WordPress administrators, installed plugins, themes, scheduled tasks, and file integrity for post-compromise persistence.

How to confirm the fix worked

Confirm the installed POST SMTP Mailer version is newer than 2.8.7 across all WordPress instances. From an unauthenticated context, request the plugin connect-app REST route and verify it returns an authorization failure and does not change the stored API key. Review plugin configuration after testing to ensure the API key was not regenerated unexpectedly. Confirm that WAF or reverse-proxy rules block unauthenticated access to the vulnerable endpoint if compensating controls are used. Validate that all WordPress admin sessions were invalidated, privileged passwords rotated, and SMTP credentials changed. Check WordPress file integrity, administrator account lists, plugin/theme inventories, and mail logs to ensure no malicious changes occurred before the fix.

Typical attack path

1. Identify WordPress sites exposing the POST SMTP Mailer plugin or its REST API routes.
2. Send an unauthenticated crafted request to the connect-app REST endpoint to exploit the type-juggling authorization bypass.
3. Reset or retrieve the plugin API key used to authenticate app/API access.
4. Use the API key to access POST SMTP Mailer logs and configuration data.
5. Search email logs for password-reset messages, authentication links, or sensitive user communications.
6. Trigger and intercept a password reset for a privileged WordPress account if needed.
7. Log in to WordPress as an administrator and establish persistence through new users, malicious plugins, modified themes, or web shells.
8. Use the compromised site for data theft, phishing, credential harvesting, lateral movement, or ransomware staging.

How to detect it

Review web server access logs, WAF events, WordPress REST API logs, PHP error logs, POST SMTP Mailer logs, authentication logs, and outbound email logs. Look for unauthenticated POST or unusual requests to the connect-app REST endpoint, followed by requests to plugin log-retrieval endpoints. Investigate any unexpected regeneration of the POST SMTP Mailer API key, changes to SMTP settings, or access to stored email logs. Correlate those events with password-reset requests, successful logins from new IP addresses, creation of new administrator accounts, plugin or theme uploads, edits to PHP files, and suspicious outbound connections. For already-compromised sites, examine wp-content uploads, plugin, and theme directories for recently modified PHP files, web shells, obfuscated code, or attacker-created persistence. Because exploitation has been associated with Black Basta ransomware operations, also review endpoint and network telemetry for follow-on credential dumping, remote access tooling, lateral movement, and ransomware staging activity after the initial WordPress event.

• /wp-json/post-smtp/v1/connect-app
• post-smtp/v1/connect-app
• POST /wp-json/post-smtp/v1/connect-app
• /index.php?rest_route=/post-smtp/v1/connect-app
• rest_route=/post-smtp/v1/connect-app
• /wp-json/post-smtp/v1/get-logs
• post-smtp/v1/get-logs
• /wp-json/post-smtp/v1/get-log
• post-smtp/v1/get-log
• wp-content/plugins/post-smtp/
• POST SMTP Mailer
• post-smtp
• wp-content/plugins/post-smtp
• wp-content/uploads/*.php
• wp-content/plugins/*/*.php
• wp-content/themes/*/*.php

What your security team should do

• Immediately inventory WordPress sites for POST SMTP Mailer versions up to and including 2.8.7 and prioritize internet-facing instances.
• Patch to the latest fixed plugin release and, where applicable to package-managed systems, apply Debian 13 linux fixed version 6.5.10-1 only after confirming product relevance.
• Rotate POST SMTP Mailer API keys, SMTP credentials, and privileged WordPress passwords after patching; assume exposed mail logs may have leaked secrets or reset links.
• Hunt web, WAF, WordPress, and plugin logs for unauthenticated access to the connect-app endpoint and subsequent mail-log API access.
• Review for WordPress account takeover indicators, including unexpected password resets, new admin users, unfamiliar plugins, modified themes, and suspicious PHP files.
• Temporarily block or tightly restrict the POST SMTP Mailer REST API routes if immediate upgrade is not possible.
• Enable MFA for WordPress administrators and reduce the number of privileged accounts.
• Correlate findings with ransomware precursor activity, especially where Black Basta-related tooling, credential harvesting, or web-shell activity is observed.