CVE-2024-52436 WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability
An attacker can perform blind SQL injection to read sensitive database information from the Post SMTP WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52436?
CVE-2024-52436 is a high-severity SQL injection vulnerability in Saad Iqbal Post SMTP, published on 18 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects Post SMTP: from n/a through <= 2.9.9.
Weakness: CWE-89
Which versions are affected by CVE-2024-52436?
It affects 1 product.
Products include Wpexperts Post Smtp.
How do I fix CVE-2024-52436?
No fix has been published for CVE-2024-52436 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-52436 being exploited?
There is no known exploitation of CVE-2024-52436 in the wild and no public exploit code.
Other vulnerabilities in Saad Iqbal Post SMTP
- CVE-2023-6875 Auth bypass in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- CVE-2023-3179 POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
- CVE-2023-52233 WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability
- CVE-2025-0521 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-5207 SQL injection in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Sources
Also known as GHSA-c9gx-rq5w-8v24.