CVE-2025-12887

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12887", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T17:28:03.418Z", "datePublished": "2025-12-03T12:29:53.626Z", "dateUpdated": "2026-04-08T16:55:27.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:27.472Z"}, "affected": [{"vendor": "saadiqbal", "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue."}], "title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402203"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-11-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-07T17:45:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-03T00:22:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T14:09:06.643764Z", "id": "CVE-2025-12887", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T14:09:43.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12887", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T14:09:06.643764Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T14:09:20.733Z"}}], "cna": {"title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "saadiqbal", "product": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-01T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-07T17:45:14.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-03T00:22:23.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402203"}], "descriptions": [{"lang": "en", "value": "The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-03T12:29:53.626Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12887", "state": "PUBLISHED", "dateUpdated": "2025-12-03T14:09:43.624Z", "dateReserved": "2025-11-07T17:28:03.418Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-03T12:29:53.626Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App", "vendor": "saadiqbal", "versions": [{"lessThanOrEqual": "3.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue."}, {"lang": "es", "value": "El plugin Post SMTP para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 3.6.1, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para actualizar tokens OAuth en la funci\u00f3n 'handle_gmail_oauth_redirect'. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, inyecten credenciales OAuth inv\u00e1lidas o controladas por el atacante."}], "id": "CVE-2025-12887", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12887", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T14:09:06.643764Z", "version": "2.0.3"}}]}, "published": "2025-12-03T13:16:01.610", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402203"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:22:08.879528+00:00", "value": {"mitigation_remediation": ["Update the Post\u202fSMTP plugin to a version newer than\u202f3.6.1, which restores the missing authorization check.", "If an update cannot be applied immediately, disable or uninstall the plugin to prevent unauthorized OAuth token changes.", "Audit the OAuth token configuration for suspicious entries and revoke any compromised or expired tokens to maintain service integrity."], "summary": {"action": "Apply Update", "impact": "Missing Authorization for OAuth Token Update"}, "threat_synthesis": {"affected_systems": "All WordPress installations that have the Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin from Saadiqbal, versions 3.6.1 and earlier. The vulnerability is limited to the plugin\u2019s OAuth authorization handling and does not affect other components of WordPress or the host server.", "description_and_impact": "The plugin contains a missing authorization check (CWE\u2011862) in the handle_gmail_oauth_redirect function, allowing any authenticated user with a subscriber role or higher to submit arbitrary OAuth credentials. The likely attack vector is an authenticated user leveraging their legitimate login to send crafted OAuth requests. This flaw can enable the attacker to inject malicious or expired tokens, granting unauthorized control over the SMTP service, which could be abused to send spam, phishing emails, or exfiltrate data.", "risk_and_exploitability": "The CVSS score of 5.4 classifies the issue as moderate severity. The EPSS score of less than 1\u202f% indicates a very low exploitation probability, and the flaw is not currently listed in CISA\u2019s KEV catalog. Exploitation requires a logged\u2011in user with subscriber\u2011level privileges, which limits the attack surface. Nonetheless, the ability to manipulate OAuth credentials presents a moderate risk to confidentiality and integrity of email communications. Patch deployment remains the recommended action."}}}}, "created": "2025-12-04T16:44:16.275363+00:00", "updated": "2026-04-22T00:30:04.047708+00:00", "vendors": ["saadiqbal", "saadiqbal$PRODUCT$post_smtp", "wordpress", "wordpress$PRODUCT$wordpress"]}