CVE-2023-52233 is a high severity (8.6) missing authorization flaw in the Post SMTP Mailer and Email Log WordPress plugin, affecting version 2.8.6 and earlier. The developer fixed it in version 2.8.7. Update the plugin to 2.8.7 or later, and if you cannot update, deactivate it until you can.
What's affected
The NVD record names WPExperts and the Post SMTP Mailer and Email Log plugin for WordPress, from the earliest release through 2.8.6. Patchstack lists 2.8.7 as the patched version. Upgrade to 2.8.7 or any later release.
The weakness is CWE-862, missing authorization. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, which gives 8.6 (High).
Patchstack lists the required privilege as unauthenticated. No login is needed. The record shows high integrity impact with low confidentiality and availability impact, and says the flaw is in the plugin API. The NVD record lists a publication date in June 2024, while the Patchstack entry is dated 5 January 2024.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get post-smtp
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 2.8.6 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Update Post SMTP Mailer and Email Log to 2.8.7 or later on staging first if you test changes, then on production.
- If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
- Review recent activity: check the email log for messages you did not send, and review your SMTP and sender settings, because the plugin handles outgoing mail.
- Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.
Why it matters
Missing authorization means the plugin runs an action without first confirming that the person asking is allowed to. The code does the work, but the permission check is absent or too weak. It is a common bug in WordPress plugins, where handlers exposed through the admin or the REST and AJAX interfaces need an explicit capability check.
The impact depends on what the unprotected action does. Here the record rates confidentiality and integrity as indicated by the vector, and Patchstack classes it as broken access control, the first item in the OWASP Top 10. A mail plugin controls how your site sends email, so an access control gap can affect password resets and notifications. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the dates for CVE-2023-52233 differ between sources?
The NVD record shows 11 June 2024 as the published date and the Patchstack entry shows 5 January 2024. I treat the Patchstack date as the first public disclosure and the NVD date as the record date. The affected and fixed versions agree.
Is there a patched version?
Yes. Patchstack lists 2.8.7 as the patched release for versions up to 2.8.6. Check the plugin's own changelog before you upgrade.
Sources
Last reviewed: 19 October 2026.
