CVE-2026-2559 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
Authenticated subscribers can overwrite Office 365 OAuth settings due to missing capability checks, potentially hijacking email configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2559?
CVE-2026-2559 is a medium-severity missing authorization vulnerability in saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro.
Weakness: CWE-862
Which versions are affected by CVE-2026-2559?
How do I fix CVE-2026-2559?
No fix has been published for CVE-2026-2559 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-2559 being exploited?
There is no known exploitation of CVE-2026-2559 in the wild and no public exploit code.
Sources
Also known as GHSA-gmrm-qq98-m6xv.