Post SMTP WordPress Plugin Authorization Bypass Vulnerability in OAuth Token Update

A vulnerability allowing authorization bypass has been identified in the Post SMTP plugin for WordPress, affecting all versions through 3.6.1. The issue arises because the plugin fails to properly verify user authorization for updating OAuth tokens in the 'handle_gmail_oauth_redirect' function. This flaw enables authenticated attackers with subscriber-level access or higher to inject invalid or attacker-controlled OAuth credentials.

Impact

Exploitation of this vulnerability allows for unauthorized modification of OAuth tokens, potentially leading to misuse of authenticated user privileges.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access or higher can send a request to the 'handle_gmail_oauth_redirect' function without the necessary authorization. The absence of proper verification allows the injection of malicious OAuth credentials.

Remediation

Users are advised to update the Post SMTP WordPress plugin to version 3.6.2 or later.