CVE-2022-2352

Post SMTP < 2.1.7 - Admin+ Blind SSRF

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.

Affected

Post SMTP Mailer/Email Log

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.38% chance of exploitation in the next 30 days, 72nd percentile

Published

2022-09-26

Updated

2025-05-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/dc99ac40-646a-4f8e-b2b9-dc55d6d4c55c

References

• CVE Record
• NVD entry