CVE•Published 2023-06-07•Modified 2026-04-08•1 article on news•6 live references•NVD data

CVE-2019-25141Wp-ecommerce · Easy_wp_smtp

Vulnerability data via NVD (ingested)

CVSS v3.1

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 2% of all CVEs

Weaknesses (CWE)

CWE-862Missing Authorization

Description

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.

Timeline

Published 2023-06-07

Modified 2026-04-08

External references

NVD MITRE Exploit-DB GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2019-25141

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · WP plugin path

http.html:"/wp-content/plugins/easy-wp-smtp/"

Matches any site loading the "easy-wp-smtp" plugin — doesn't rely on Shodan's vuln tag.

Shodan · product

product:"Wp-ecommerce Easy Wp Smtp"

All exposed Wp-ecommerce Easy Wp Smtp instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Easy Wp Smtp"

HTTP body or banner mentions "Easy Wp Smtp" — catches deploys Shodan didn't identify as a product.