CVE-2025-11833

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 4, 2025

Last Seen

January 20, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Vulnerability in Post SMTP Plugin Allows Account Takeover on 400K WordPress Sites59.4

A security vulnerability in the Post SMTP plugin, used in over 400,000 WordPress installations, has been discovered that enables unauthenticated attackers to take control of administrator accounts and entire WordPress sites. The flaw was reported to Wordfence on October 11, and attacks exploiting th...

Critical Vulnerability in ACF Extended Plugin Threatens 100,000 WordPress Sites26.6

A critical security vulnerability has been identified in the Advanced Custom Fields: Extended plugin for WordPress, affecting up to 100,000 websites. The flaw allows unauthenticated attackers to gain administrative permissions, with a severity rating of 9.8 assigned to the vulnerability, tracked as...

Vulnerability in Post SMTP Plugin Allows WordPress Account Takeover13.6

A critical vulnerability in the Post SMTP plugin, used by over 400,000 WordPress sites, has been discovered, allowing unauthenticated attackers to hijack administrator accounts. The flaw enables attackers to access email logs and reset passwords, compromising entire WordPress instances. A patch for...