WordPress Alert: 400,000 Sites at Risk from Post SMTP Vulnerability—Update Now!
Move over, hackers! Your new favorite WordPress plugin, Post SMTP, has a flaw that turns password reset emails into your personal treasure map. With a CVSS score of 9.8, it’s the hottest ticket in town for account takeover attacks. Update to version 3.6.1 pronto, or risk your website becoming a hacker’s playground!
Hot Take:
WordPress users are playing a high-stakes game of “Who’s Got Your Password?” thanks to a Post SMTP plugin vulnerability. If you’re still using version 3.6.0, it’s time to update faster than you can say ‘SMTP’. Otherwise, your website might be hosting an unauthorized ‘Takeover Party’ with administrators arriving fashionably hacked.
Key Points:
– A critical vulnerability in Post SMTP WordPress plugin exposes sites to account takeover.
– The flaw is present in versions up to 3.6.0, allowing attackers to read email logs.
– Attackers can exploit the flaw to hijack password reset emails and access accounts.
– The vulnerability scored a 9.8 on the CVSS scale and is tracked as CVE-2025-11833.
– Users are urged to update to version 3.6.1 immediately as active exploits are occurring.