CVE-2025-12887

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 3, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-128887.5Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPUCVE-2025-128895.4With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateReCVE-2025-12894.8The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege usersCVE-2025-128906.5Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triCVE-2025-128915.3The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_showCVE-2025-128925.3The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivateCVE-2025-128935.4Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documenCVE-2025-128945.3The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in allCVE-2025-128955.3The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capabCVE-2025-128964.4Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authoriCVE-2025-128985.3The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_CVE-2025-128996.5A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results