CVE-2023-6875 is a critical (CVSS 9.8) authorization bypass in the POST SMTP Mailer plugin for WordPress, all versions up to and including 2.8.7. Unauthenticated attackers can reset the API key and read logs, including password reset emails. Update beyond 2.8.7 immediately.
What's affected
The record says all versions up to and including 2.8.7 are affected. It also notes that CVE-2023-52233 appears to be a duplicate of this issue. The flaw is on the connect-app REST endpoint and needs no login.
The Wordfence and WordPress.org changeset pages in the record did not load for automated reading, so the exact fixed version is not restated. Any release above 2.8.7 is the starting point, and the plugin changelog will name the fix.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get post-smtp --field=version
Versions up to and including 2.8.7 are affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update post-smtp, or use the Plugins screen. Confirm the version is above 2.8.7. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Reset the plugin's API key and mail credentials after updating, and review the plugin's email logs for sensitive content.
- Check administrator accounts and recently reset passwords for signs of takeover.
Why it matters
The record says a type juggling issue on the connect-app REST endpoint lets an attacker reset the API key used to authenticate to the mailer. With that key they can view logs, which hold password reset emails, and that allows site takeover. The record tags CWE-639 and CWE-862.
Type juggling bugs arise when a language compares values of different types loosely, so a value that should fail a check passes it. The lesson is to use strict comparison for secrets and to avoid storing sensitive emails in logs.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-639 (Authorization Bypass Through User-Controlled Key) CWE-862 (Missing Authorization).
Quick check
Why are email logs so sensitive?
Mail logs keep the full body of messages. Password reset links in them let someone who can read the log take over an account.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
