CVE-2024-25914: Photoboxone SMTP Mail CSRF Vulnerability

CVE-2024-25914 Overview

CVE-2024-25914 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Photoboxone SMTP Mail plugin for WordPress. The flaw exists in all versions up to and including 1.3.20. An attacker can trick an authenticated administrator into submitting forged requests that modify the plugin's SMTP configuration. Successful exploitation requires user interaction, typically through a malicious link or crafted page. The vulnerability is tracked under CWE-352 and was published to the National Vulnerability Database on February 13, 2024.

Critical Impact
Attackers can hijack administrative actions to alter SMTP settings, redirect outbound mail, or weaponize the WordPress mail subsystem for phishing and credential theft.

Affected Products

Photoboxone SMTP Mail plugin for WordPress
All versions from initial release through 1.3.20
WordPress sites where the plugin is active and administrators have not applied an update

Discovery Timeline

2024-02-13 - CVE-2024-25914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25914

Vulnerability Analysis

The Photoboxone SMTP Mail plugin exposes administrative actions without validating the origin of incoming requests. State-changing endpoints accept POST submissions without verifying a WordPress nonce or equivalent anti-CSRF token. An attacker hosting a malicious page can include hidden forms or scripts that auto-submit requests to a victim's WordPress instance. If the victim holds an active administrator session, the browser attaches authentication cookies and the request executes with full privileges.

The vulnerability maps to CWE-352: Cross-Site Request Forgery. It enables a remote attacker to invoke privileged actions without compromising credentials directly. Because the SMTP plugin governs outbound mail configuration, abuse can route notifications, password resets, and transactional mail through attacker-controlled relays.

Root Cause

The plugin's request handlers omit wp_verify_nonce() checks or equivalent token validation on administrative form submissions. WordPress provides nonce primitives specifically to prevent CSRF, and their absence on settings endpoints permits cross-origin request forgery.

Attack Vector

An attacker delivers a crafted link, embedded image, or malicious page to a logged-in WordPress administrator. The page issues a forged POST request to the plugin's settings handler. The browser submits authenticated session cookies alongside the request. The plugin processes the change and persists attacker-supplied SMTP server, port, username, and password values. Subsequent WordPress mail flows through the attacker's infrastructure.

No proof-of-concept exploit is publicly listed for CVE-2024-25914 at the time of this writing. See the Patchstack CSRF Vulnerability Report for vendor-supplied technical details.

Detection Methods for CVE-2024-25914

Indicators of Compromise

Unexpected modifications to SMTP Mail plugin settings, including changed host, port, username, or sender address
WordPress outbound mail routed through unfamiliar relay servers
Administrator browser sessions visiting unsolicited external pages immediately before SMTP configuration changes
Web server access logs showing POST requests to plugin admin endpoints with external Referer headers

Detection Strategies

Audit WordPress options table entries owned by the SMTP Mail plugin for unauthorized modifications
Inspect web server logs for POST requests to wp-admin endpoints lacking same-origin Referer headers
Correlate administrator login sessions with subsequent configuration changes to identify request forgery patterns
Monitor outbound SMTP connections from the web host for new or unexpected destinations

Monitoring Recommendations

Enable WordPress audit logging to record all plugin settings changes with user, IP, and timestamp
Alert when SMTP server hostnames or credentials change outside scheduled maintenance windows
Track outbound port 25, 465, and 587 traffic for connections to non-approved mail relays
Review administrator account activity for unusual browsing patterns preceding configuration changes

How to Mitigate CVE-2024-25914

Immediate Actions Required

Update the Photoboxone SMTP Mail plugin to a version later than 1.3.20 once the vendor publishes a fix
Deactivate and remove the plugin if no patched version is available and replace it with a maintained SMTP plugin
Force-reset SMTP credentials stored in the plugin to ensure any attacker-injected values are revoked
Require administrators to log out of WordPress before browsing untrusted sites

Patch Information

The vulnerability affects versions up to and including 1.3.20. Refer to the Patchstack CSRF Vulnerability Report for the latest vendor remediation status and any released patched version.

Workarounds

Restrict access to wp-admin by IP allowlist using web server or WAF rules
Deploy a Web Application Firewall rule that blocks POST requests to plugin admin endpoints lacking valid WordPress nonces
Enforce SameSite=Strict cookies for WordPress session cookies to limit cross-origin cookie attachment
Require administrators to use dedicated browser profiles or sessions isolated from general browsing

bash

# Example nginx rule restricting wp-admin access by source IP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}