Critical · published January 11, 2024
CVSS calls it critical at 9.8. It sits in the 99.8th percentile for exploit probability.
🚨 A type juggling issue in the POST SMTP Mailer plugin for WordPress means that any unauthorized attacker can gain access to your email logs and even modify them! 🔥 Think of it like a restaurant where anyone can walk in and reset the chef's secret recipe, seeing all the orders made by customers — that’s how easily this vulnerability allows attackers into your sensitive data! With this vulnerability, an attacker could reset the API key, allowing them to hijack email logs and view sensitive information like password reset emails. This could lead to a complete site takeover — absolutely devastating! ⚡
Think of it like a restaurant where anyone can walk in and reset the chef's secret recipe, seeing all the orders made by customers — that’s how easily this vulnerability allows attackers into your sensitive data! This issue stems from a type juggling vulnerability in the connect-app REST endpoint, allowing unauthenticated users to manipulate the API key used for authentication and access sensitive information.
With this vulnerability, an attacker could reset the API key, allowing them to hijack email logs and view sensitive information like password reset emails. This could lead to a complete site takeover — absolutely devastating! ⚡ Immediately update the POST SMTP Mailer plugin to version 2.8.8 or later to address this vulnerability. Consider reviewing the API key access and implementing additional authentication checks to safeguard against unauthorized access. 🛡️ You've got this! Follow these steps to lock down your WordPress site and stay secure! 💪