Known vulnerabilities in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

Improve WordPress email deliverability. Connect Gmail SMTP, Microsoft 365, Brevo, SendGrid, Mailgun, Zoho, Amazon SES, etc. #1 WordPress SMTP Plugin.

26Reported vulnerabilities

9.8Highest CVSS score

3.9.5Latest version

300,000+Active installs

What to do now

Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to 4.0.1 or later. 26 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-6875	Critical 9.8	90.3%	2.8.7 and earlier	`2.8.8`	January 11, 2024
CVE-2025-11833	Critical 9.8	51.0%	0 to 3.6.0 (inclusive)	`3.6.1`	November 1, 2025
CVE-2023-6620	High 7.2	14.1%	Before 2.8.7	`2.8.7`	January 15, 2024
CVE-2023-3179	High 8.8	0.4%	Before 2.5.7	`2.5.7`	July 17, 2023
CVE-2022-2352	High 7.2	1.1%	Before 2.1.7	`2.1.7`	September 26, 2022
CVE-2023-5958	Medium 6.1	0.5%	Before 2.7.1	`2.7.1`	November 27, 2023
CVE-2023-6621	Medium 6.1	0.4%	Before 2.8.7	`2.8.7`	January 3, 2024
CVE-2023-7027	Medium 5.4	0.9%	Before 2.8.8	`2.8.8`	January 3, 2024
CVE-2025-24000	High 8.8	0.6%	3.2.0 and earlier	`3.3.0`	July 21, 2025
CVE-2022-2351	Medium 4.8	0.6%	Before 2.1.4	`2.1.4`	September 16, 2022
CVE-2023-3178	Medium 4.3	0.3%	Before 2.5.7	`2.5.7`	January 16, 2024
CVE-2024-5207	High 7.2	0.5%	Before 2.9.4	`2.9.4`	May 30, 2024
CVE-2026-48838	High 7.2	0.2%	3.6.2 and earlier	`3.6.3`	May 28, 2026
CVE-2026-3090	High 7.2	0.2%	0 to 3.8.0 (inclusive)	`3.9.0`	March 18, 2026
WF-3816a6cf-8157-4ad9-83f6-93c9b6c6275f	High 7.2	—	Before 2.6.1	`2.6.1`	October 3, 2023
CVE-2026-81278	Medium 6.3	0.2%	4.0.0-beta.1 to 4.0.0-beta.1 (inclusive)	`4.0.1`	August 26, 2026
CVE-2025-0521	Medium 6.1	0.3%	Before 3.1.0	`3.1.0`	February 18, 2025
CVE-2023-6629	Medium 6.1	0.4%	Before 2.8.7	`2.8.7`	January 3, 2024
CVE-2023-3082	Medium 6.1	0.5%	Before 2.5.8	`2.5.8`	July 12, 2023
CVE-2025-12887	Medium 5.4	0.3%	3.6.1 and earlier	`3.6.2`	December 3, 2025
CVE-2026-2559	Medium 5.3	0.2%	0 to 3.8.0 (inclusive)	`3.9.0`	March 18, 2026
CVE-2024-13844	Medium 4.9	0.4%	Before 3.1.3	`3.1.3`	March 8, 2025
CVE-2024-52436	Medium 4.9	0.5%	2.9.9 and earlier	`2.9.10`	November 15, 2024
CVE-2021-4422	Medium 4.3	0.5%	2.0.20 and earlier	`2.0.21`	July 12, 2023
CVE-2025-9219	Medium 4.3	0.2%	0 to 3.4.1 (inclusive)	`3.4.2`	September 3, 2025
CVE-2025-22800	Medium 4.3	0.4%	2.9.11 and earlier	`2.9.12`	January 7, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.