WordPress SMTP Mail 插件 <= 1.3.51 - 跨站请求伪造 (CSRF) 漏洞

The CSRF vulnerability in photoboxone SMTP Mail allows an attacker to execute actions on behalf of an authenticated user without their knowledge or consent. This could involve sending malicious emails, modifying email configurations, or potentially gaining access to sensitive data associated with the user's email account. The attacker would need to craft a malicious request and trick the user into visiting a crafted link or page. Successful exploitation could lead to significant disruption of email services and compromise of user data, particularly if the SMTP Mail plugin is integrated with other critical systems.

WordPress websites utilizing the photoboxone SMTP Mail plugin, particularly those with user accounts that have administrative privileges or access to sensitive email data, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise of one site could lead to exploitation of others.

• wordpress / composer / npm:

grep -r 'photoboxone SMTP Mail' /var/www/html/wp-content/plugins/
wp plugin list | grep smtp-mail

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/smtp-mail/ | grep Content-Security-Policy

1. 2025-12-09Disclosure

   disclosure

1. 已保留2025-10-21
2. 发布日期2025-12-09
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-62762 is to upgrade photoboxone SMTP Mail to a version containing the security fix. If upgrading immediately is not feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include implementing strict Content Security Policy (CSP) headers to restrict the origins from which scripts can be executed, or using nonce-based validation for form submissions. Web Application Firewalls (WAFs) can also be configured to detect and block malicious CSRF requests. Monitor SMTP logs for suspicious activity.