WordPress Woes: Post SMTP Vulnerability Leaves 210,000 Sites Open to Hacker Hijinks
Watch out, WordPress users! The Post SMTP plugin is in hot water with a critical vulnerability, CVE-2025-11833, letting hackers hijack admin accounts. If your site uses this email delivery solution, update to version 3.6.1 pronto or risk joining the 210,000 sites left vulnerable to admin takeover attacks. Stay safe, patch wisely!
Hot Take:
Looks like WordPress plugins are having a midlife crisis, with Post SMTP strutting around like a rebellious teenager leaving the door unlocked for internet burglars. Maybe it’s time for these plugins to start acting their age and get some security maturity!
Key Points:
- Post SMTP plugin vulnerability (CVE-2025-11833) impacts over 400,000 WordPress sites.
- Vulnerability allows unauthorized access to email logs, enabling account takeovers.
- Patch available as of October 29, but nearly half of users remain vulnerable.
- Active exploitation started on November 1, with over 4,500 blocked attempts.
- Website owners should update to version 3.6.1 or disable the plugin immediately.
Already a member? Log in here