POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).

N/A

N/A

WordPress plugin POST SMTP Mailer 跨站请求伪造漏洞

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin POST SMTP Mailer 2.5.7之前版本存在跨站请求伪造漏洞，该漏洞源于在某些AJAX操作中没有适当的CSRF检查，可能允许攻击者发送电子邮件到任意地址。

N/A

N/A