CVE-2023-6620 is a high severity SQL injection in the POST SMTP Mailer plugin for WordPress. Several parameters are not sanitised or escaped before use in SQL statements. High privilege users such as admins can exploit it. Versions before 2.8.7 are affected, so update to 2.8.7 or later.
What's affected
- Product: POST SMTP Mailer from WPExperts, a WordPress plugin.
- Affected: versions before 2.8.7, per the record.
- Fixed: 2.8.7.
- Role needed: administrator or similar high privilege.
The record gives a CVSS 3.1 base score of 7.2 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on each site.
- Update POST SMTP Mailer to 2.8.7 or later.
- Review administrator accounts, remove those unneeded, and enable two factor sign in for the rest.
- Check your mail logs inside the plugin for unfamiliar messages or settings.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-89 (SQL Injection): User controlled values are placed into a database query without proper escaping or parameter binding, so the query text itself can be changed.
The record lists SQL injection. Request parameters go into SQL statements without escaping, so a user who can reach those requests can change what the query does.
Because administrator rights are needed, the base score is 7.2 and the risk centres on stolen admin credentials. The plugin handles outgoing mail settings, which can include SMTP credentials, so a database read here may reach more than site content. Update, then rotate the SMTP password if you have any doubt.
Quick check
Do attackers need to be logged in?
Yes. The record says it is exploitable by high privilege users such as admin.
What should I rotate after patching?
If there is any sign of misuse, rotate the SMTP credentials stored by the plugin and the WordPress admin passwords.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
