Vulnerable SMTP Plug-In Puts 150,000 WordPress Sites At Risk
A widely-used WordPress plug-in, designed to enhance email functionality, has been identified as a potential threat to the security of 150,000 websites. In a recent discovery reported by Techzine Europe, the POST SMTP plugin, responsible for speeding up email transmissions, exposes websites to a takeover risk due to a critical vulnerability.
Swift Developer Response
Despite the severity of the issue, the developer, WPExperts.io, demonstrated a commendable commitment to security. The vulnerability was responsibly disclosed during a bug bounty program in December. Subsequently, WPExperts.io swiftly responded, releasing an official patch on January 1. Regrettably, it appears that a significant number of websites, approximately 150,000, have yet to implement this crucial update.
Operation of the Vulnerability
The identified vulnerability allows unauthorized access to sensitive data and provides an opportunity to reset the API key, a critical authentication element for the mailer. Furthermore, it exposes logs, including login credentials, potentially leading to a complete website takeover. The vulnerability is attributed to a type juggling flaw present in all versions of the plug-in up to 2.8.8.
Read More: How To Earn A Free SSL Certificate For Your WordPress Website
Additional Firewall Measures
Wordfence, a cybersecurity service, promptly responded to the threat. Paid Wordfence users were equipped with a firewall rule on January 3 as an immediate protective measure. Users of the free platform will receive the same layer of protection on February 2.
Importance of POST SMTP
POST SMTP is designed to replace the default PHP mail system within WordPress with the more secure SMTP protocol. One of its key advantages is reducing the likelihood of sent emails ending up in recipients’ spam folders. However, the recent vulnerability underscores the critical need for vigilance and timely updates, even for popular and seemingly secure plugins.
Frequently Asked Questions
Q1: What is the POST SMTP plugin?
A1: POST SMTP is a WordPress plugin designed to replace the default mail system with the SMTP protocol, offering improved email delivery and reducing the risk of emails being marked as spam.
Q2: How does the vulnerability impact websites?
A2: The vulnerability allows unauthorized access to data, potential manipulation of API keys, and exposure of login credentials, posing a significant risk of a complete website takeover.
Q3: What actions have been taken to mitigate the risk?
A3: The developer, WPExperts.io, promptly released an official patch on January 1. Wordfence also provided firewall rules to its paid users, with the same protection extended to free platform users on February 2.
Read More: Vulnerability Alert: WordPress Google Fonts Plugin at Risk
Conclusion
The recent revelation of vulnerabilities in the POST SMTP plugin emphasizes the importance of prompt updates and security measures for WordPress site owners. With cyber threats evolving, users must remain vigilant and prioritize the security of their websites.
