Post SMTP plugin flaw exploited to take over admin accounts: update to 3.6.1 or later

In late October 2025, the makers of Post SMTP, an email plugin that Wordfence counts on more than 400,000 WordPress sites, released version 3.6.1 to fix a critical flaw (CVE-2025-11833). The vendor shipped the patch on October 29, 2025. Before that, anyone without an account could read the emails the plugin logs, including password reset emails. An attacker could request a password reset for the administrator, read the reset link in the log, and take over the site.

Wordfence reported that attacks started on November 1, 2025, the day after the flaw was added to its database, and that mass exploitation began on November 2. By November 19, its firewall had blocked more than 10,300 attempts.

If your site has updated since then, you are most likely already protected, but check the version.

Who is affected

• Sites running Post SMTP version 3.6.0 or earlier.
• The risk exists as soon as the plugin logs emails, which is one of its main features.

How to check your site

1. In WordPress, open Plugins and find Post SMTP. The version number appears under its name.
2. If it shows 3.6.0 or lower, the site was exposed.
3. Open Users and filter by Administrator. Look for accounts you do not recognise.
4. Think back: did you or a colleague receive an unexpected password reset email, or find that an administrator password no longer worked?

What to do now

1. Update Post SMTP to the latest version from the Plugins page (3.6.1 or later).
2. If the site ran an old version for a long time, change the passwords of every administrator account, starting with yours.
3. If you find an unknown administrator or a plugin you did not install, treat the site as compromised and ask your host or a security professional to clean it.
4. Turn on automatic updates for this plugin from the Plugins page so future fixes arrive on their own.

This alert reports what the sources listed below published and is not a guarantee about any specific site.