CVE-2026-2559: Post SMTP Auth Bypass Vulnerability

CVE-2026-2559 Overview

The Post SMTP plugin for WordPress contains an authorization bypass vulnerability in the handle_office365_oauth_redirect() function that allows authenticated attackers with minimal privileges to overwrite critical Office 365 OAuth mail configuration. This vulnerability exists in all versions up to and including 3.8.0 and stems from a missing capability check when the function is hooked to admin_init.

The vulnerability is classified as CWE-862 (Missing Authorization), where the function fails to implement current_user_can() checks or nonce verification, enabling attackers to manipulate access tokens, refresh tokens, and user email settings through crafted URLs.

Critical Impact
Attackers with Subscriber-level access can hijack Office 365 OAuth configuration, potentially tricking administrators into connecting the plugin to attacker-controlled Azure applications during Microsoft365 SMTP wizard setup.

Affected Products

Post SMTP WordPress Plugin versions up to and including 3.8.0
WordPress sites using Post SMTP with Office 365 OAuth integration
Post SMTP Pro users configuring Microsoft365 SMTP

Discovery Timeline

2026-03-18 - CVE-2026-2559 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-2559

Vulnerability Analysis

This authorization bypass vulnerability affects the Post SMTP WordPress plugin's OAuth implementation for Microsoft Office 365 integration. The core issue resides in the handle_office365_oauth_redirect() function located in the NewWizard.php file, which is improperly hooked to WordPress's admin_init action without adequate security controls.

When a WordPress site loads admin pages, functions hooked to admin_init execute regardless of the user's actual capabilities. In this case, the vulnerable function processes OAuth redirect parameters without verifying whether the requesting user has administrative privileges or whether the request contains a valid nonce token. This architectural flaw allows any authenticated user, including those with minimal Subscriber-level permissions, to inject arbitrary OAuth configuration values.

The attack enables overwriting of the site's Office 365 OAuth mail configuration, specifically the access token, refresh token, and associated user email. While the direct exploitation requires authentication, the impact is significant because it can manipulate the Microsoft365 SMTP wizard setup process used in the Pro version of the plugin.

Root Cause

The root cause is the absence of proper authorization checks in the handle_office365_oauth_redirect() function. WordPress best practices require that any function modifying site configuration must implement capability checks using current_user_can() to verify the user has appropriate permissions. Additionally, state-changing operations should validate nonce tokens to prevent cross-site request forgery. The vulnerable code implements neither safeguard, allowing low-privileged authenticated users to access functionality intended exclusively for administrators.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the WordPress site. An attacker with a valid Subscriber account can craft a malicious URL containing manipulated OAuth parameters. When this URL is processed by the vulnerable function during an admin_init hook execution, the attacker's OAuth credentials overwrite the legitimate configuration.

The exploitation scenario involves the attacker replacing the site's Office 365 OAuth configuration with parameters pointing to their controlled Azure application. When a site administrator later attempts to configure or verify the Microsoft365 SMTP integration through the Pro wizard, they may unknowingly authorize the attacker's Azure application, believing it to be their own. This social engineering component amplifies the vulnerability's impact beyond simple configuration manipulation.

Detection Methods for CVE-2026-2559

Indicators of Compromise

Unexpected changes to Post SMTP Office 365 OAuth configuration settings
Unfamiliar access tokens or refresh tokens in the plugin's mail configuration
OAuth configuration email addresses that do not match known administrator accounts
Suspicious administrative URL access patterns from low-privileged user accounts
Audit log entries showing configuration changes initiated by non-administrator users

Detection Strategies

Monitor WordPress option changes related to Post SMTP OAuth settings for unauthorized modifications
Implement file integrity monitoring on the NewWizard.php file and related plugin components
Review WordPress user session logs for Subscriber-level accounts accessing admin endpoints
Configure web application firewall rules to detect crafted OAuth redirect parameter patterns
Enable detailed logging for all Post SMTP plugin configuration changes

Monitoring Recommendations

Deploy endpoint detection and response (EDR) solutions to monitor WordPress installations for anomalous plugin behavior
Implement real-time alerting for changes to critical plugin configuration options
Establish baseline OAuth configuration values and alert on any deviations
Monitor Azure application authorization logs for unexpected consent grants
Review authentication logs for patterns of low-privilege users triggering admin functions

How to Mitigate CVE-2026-2559

Immediate Actions Required

Update Post SMTP plugin to the latest patched version immediately
Audit current Post SMTP OAuth configuration for any unauthorized changes
Review WordPress user accounts and revoke access for any suspicious Subscriber-level accounts
Reset Office 365 OAuth tokens and reconfigure the integration with verified credentials
Temporarily disable Post SMTP Office 365 integration if update cannot be immediately applied

Patch Information

The vulnerability has been addressed in WordPress Changeset #3484515. Users should update to the latest version of Post SMTP that includes proper capability checks and nonce verification in the handle_office365_oauth_redirect() function. The vulnerable code can be reviewed in the WordPress Post SMTP repository. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

Restrict user registration on WordPress sites to prevent attackers from obtaining Subscriber accounts
Implement additional access controls using security plugins to limit admin page access for low-privilege users
Use a web application firewall to block requests containing OAuth redirect parameters from non-administrator sessions
Disable the Post SMTP plugin entirely until the patch can be applied if Office 365 integration is not critical
Monitor all plugin configuration changes through a WordPress security audit plugin until remediation is complete

bash

# Verify Post SMTP plugin version and check for updates
wp plugin list --name=post-smtp --fields=name,status,version,update
wp plugin update post-smtp
# Review recent plugin option changes for suspicious activity
wp option get postman_options