CVE-2025-12887 is an authorization bypass vulnerability in the Post SMTP plugin for WordPress, affecting all versions up to 3.6.1. The issue arises because the plugin does not properly verify user authorization when updating OAuth tokens in the 'handle_gmail_oauth_redirect' function. As a result, authenticated users with subscriber-level privileges or higher can inject invalid or malicious OAuth credentials. This vulnerability is categorized under CWE-862 (Missing Authorization). No official patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject attacker-controlled OAuth credentials into the plugin's configuration. This could lead to unauthorized use or manipulation of OAuth tokens, potentially impacting email deliverability or allowing further abuse of the SMTP functionality. There is no indication of direct confidentiality impact, but integrity and availability impacts are possible as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to OAuth token updates within the plugin configuration.