CVE-2023-6875
CRITICAL EXPLOITED NUCLEIWordpress POST SMTP Account Takeover
Title source: metasploitExploitation Summary
CVE-2023-6875 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including UlyssesSaicha, gbrsh, hatlesswizard, including a Metasploit module auxiliary/admin/http/wp_post_smtp_acct_takeover.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an authentication bypass vulnerability in the Post SMTP plugin for WordPress, allowing unauthorized access to email logs and sensitive information via crafted FCM token headers.
Description
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Exploits (4)
This PoC demonstrates an authentication bypass vulnerability in the Post SMTP plugin for WordPress, allowing unauthorized access to email logs and sensitive information via crafted FCM token headers.
This repository contains a functional exploit for CVE-2023-6875, which targets PostSMTP Mailer for unauthorized account takeover. The exploit leverages a vulnerability in the plugin to steal password reset keys and change user passwords.
This Go-based exploit targets a WordPress plugin vulnerability (CVE-2023-6875) by abusing the Post SMTP plugin's API to intercept password reset emails, extract the reset link, and upload a malicious shell. It automates the entire attack chain from token placement to admin login.
This Metasploit module exploits CVE-2023-6875, a privilege escalation vulnerability in the WordPress POST SMTP plugin prior to 2.8.7. It allows an unauthenticated attacker to reset the password of an arbitrary user by leveraging password reset functionality and accessing email logs.
Nuclei Templates (1)
http.html:/wp-content/plugins/post-smtp
body=/wp-content/plugins/post-smtp
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H