# CVE-2025-11833: Post SMTP - Information Disclosure

> Live exploitation tracking for CVE-2025-11833 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-11833

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** SAADIQBAL Post SMTP
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress

## Description

The Post SMTP - Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.

## CrowdSec analysis

[CVE-2025-11833](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-11833) is a critical vulnerability in the Post SMTP - Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress, allowing unauthenticated attackers to access arbitrary logged emails due to a missing capability check. Exploiting this flaw could enable attackers to read sensitive emails, including password reset messages, potentially leading to full account takeover and further compromise of affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-11833 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending unauthenticated POST requests to `/wp-login.php` with specific query parameters such as `action=lostpassword&page=postman_email_log&view=log&log_id=`, allowing them to access and read sensitive email logs.

## Timeline

- 2025-11-01: CVE Published. CVE-2025-11833 is published to NVD.
- 2026-01-07: Rule Released. CrowdSec releases a rule to detect CVE-2025-11833 exploitation attempts against the CrowdSec Network.
- 2026-01-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-11833 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11833.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-11833) follows observed exploitation activity for CVE-2025-11833. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.