Post SMTP - Information Disclosure (CVE-2025-11833)
Description
The Post SMTP - Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
psychologyCrowdSec Analysis
CVE-2025-11833 is a critical vulnerability in the Post SMTP - Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress, allowing unauthenticated attackers to access arbitrary logged emails due to a missing capability check. Exploiting this flaw could enable attackers to read sensitive emails, including password reset messages, potentially leading to full account takeover and further compromise of affected WordPress sites.
CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-11833 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending unauthenticated POST requests to /wp-login.php with specific query parameters such as action=lostpassword&page=postman_email_log&view=log&log_id=, allowing them to access and read sensitive email logs.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-11-01 |
| Rule Released | 2026-01-07 |
| CrowdSec First Seen | 2026-01-27 |