CVE-2025-67563
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.
Risk Assessment
The risk involves potential unauthorized access to functionality, which could lead to security breaches and data integrity issues.
Recommendation
It is recommended to update the plugin to the latest version and review access control configurations.
Other vulnerabilities in Post SMTP
See all- CVE-2026-81278Medium
Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.
- CVE-2026-48838High
Versions of Post SMTP <= 3.6.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS