CVE-2023-6875: WordPress POST SMTP Mailer plugin type juggling allows unauthenticated API key reset and log access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS score is 9.8 (critical) and EPSS is very high, with unauthenticated remote exploitation leading to site takeover.

What it is

The POST SMTP Mailer WordPress plugin (all versions up to and including 2.8.7) has a type juggling flaw on the connect-app REST endpoint that bypasses authorization. Unauthenticated attackers can reset the mailer API key and read logs, including password reset emails, which can lead to full site takeover.

Impact

An attacker gains unauthorized access to sensitive email logs and can reset the API key used to authenticate to the mailer, enabling site takeover.

Attack surface

Reachable over the network via the connect-app REST endpoint with no authentication or user interaction required, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS probability is 0.90339 (99.792th percentile), indicating very high likelihood of exploitation; references include third-party advisories and a Packet Storm entry.

What to do

• Update the POST SMTP Mailer plugin to a version newer than 2.8.7 immediately.
• If patching is not possible, disable or restrict access to the connect-app REST endpoint.
• Rotate the mailer API key and any credentials exposed in logs.
• Review email logs for unauthorized access or password reset emails.
• Apply virtual patching or WAF rules to block unauthenticated requests to the vulnerable endpoint.

Detection

• Monitor for unauthenticated POST requests to the connect-app REST endpoint.
• Alert on API key reset events or changes to mailer configuration.
• Review access logs for unusual access to email log data.
• Check for signs of site takeover such as new admin users or modified settings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.