CVE-2021-4422 POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass

What is CVE-2021-4422?

CVE-2021-4422 is a medium-severity vulnerability in saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App, published on 12 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2021-4422?

It affects 1 product.

Products include Wpexperts Post Smtp.

How do I fix CVE-2021-4422?

No fix has been published for CVE-2021-4422 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-4422 being exploited?

There is no known exploitation of CVE-2021-4422 in the wild and no public exploit code.

Other vulnerabilities in saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

• CVE-2023-6875 Auth bypass in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Critical 9.8
• CVE-2023-3179 POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF High 8.8
• CVE-2023-52233 WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability High 8.6
• CVE-2024-52436 WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability High 7.6
• CVE-2025-0521 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7qhm-w96c-j5vq.