CVE-2023-3179 POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
Attackers can exploit missing CSRF checks to force users to resend emails to attacker addresses, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-3179?
CVE-2023-3179 is a high-severity vulnerability in Unknown POST SMTP Mailer, published on 17 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Weakness: CWE-352
Which versions are affected by CVE-2023-3179?
It affects 1 product.
Products include Wpexperts Post Smtp.
How do I fix CVE-2023-3179?
No fix has been published for CVE-2023-3179 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-3179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3179 exists.
Other vulnerabilities in Unknown POST SMTP Mailer
- CVE-2023-6875 Auth bypass in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- CVE-2023-52233 WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability
- CVE-2024-52436 WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability
- CVE-2025-0521 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-5207 SQL injection in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Sources
Also known as GHSA-6qcm-jr9r-5m65.