The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App WordPress plugin suffers from a missing capability check in its __construct function in all versions up to 3.6.0. This authorization bypass vulnerability (CWE-862) allows unauthenticated attackers to read arbitrary logged emails sent through the plugin. Exploitation could expose sensitive information such as password reset emails containing reset links, potentially enabling account takeover. The vulnerability is remotely exploitable without authentication or user interaction, resulting in high confidentiality, integrity, and availability impact. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor as of the publication date.

An attacker can remotely access sensitive logged emails without authentication, including password reset emails. This exposure can lead to account takeover and compromise of user accounts. The vulnerability affects confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Post SMTP plugin or restricting access to its logs and email data to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.