A critical security vulnerability has been discovered in the Post SMTP WordPress plugin, which is actively used on over 400,000 websites for handling email delivery. The flaw, tracked as CVE-2025-24000, caused by broken access controls in the plugin’s REST API, allows any logged-in user (including low-privileged roles like subscribers) to access sensitive email logs without proper permission checks. These logs may include full email contents such as password reset messages sent to administrators, enabling attackers to hijack admin accounts and gain full control of impacted sites. The vulnerability was reported to Patchstack in May, and a fix was implemented in version 3.3.0, released on June 11. However, download statistics indicate that fewer than 50% of users have updated to the patched version, leaving over 200,000 websites still vulnerable. Additionally, nearly 97,000 sites remain on even older 2.x versions, which contain further security issues. CTIX analysts strongly urge administrators to update the plugin immediately, as unpatched plugins and themes remain one of the most exploited vectors for compromising WordPress sites.