What is the GHSA ID for CVE-2021-4422?

GitHub tracks CVE-2021-4422 as GHSA-7qhm-w96c-j5vq.

What is the CVSS score of CVE-2021-4422?

CVE-2021-4422 has a CVSS 3.1 base score of 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Which versions are affected by CVE-2021-4422?

https://github.com/wpexpertsio/post-smtp (GIT): <= 2.0.20.

How do I fix CVE-2021-4422?

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

What is the Package URL (PURL) for CVE-2021-4422?

The affected package's PURL is pkg:github/wpexpertsio/post-smtp.

Is CVE-2021-4422 exploited in the wild?

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-4422. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

CVE-2021-4422GHSA-7qhm-w96c-j5vq

POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass

Q: How do I fix CVE-2021-4422?

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

Q: What is the Package URL (PURL) for CVE-2021-4422?

The affected package's PURL is pkg:github/wpexpertsio/post-smtp.

Q: Is CVE-2021-4422 exploited in the wild?

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-4422. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

CVE-2021-4422 (GitHub advisory GHSA-7qhm-w96c-j5vq) is a medium-severity vulnerability with a CVSS 3.1 base score of 4.3, classed as Cross-Site Request Forgery (CSRF) (CWE-352), in github.com/wpexpertsio/post-smtp (Git repository). Affected versions: <= 2.0.20. No fixed version has been published yet.

Medium4.3No fix yetUnreviewed advisory

Published 12 Jul 2023Updated 8 Apr 2026

4.3MediumCVSS 3.1

CVE ID: CVE-2021-4422
GHSA ID: GHSA-7qhm-w96c-j5vq
EPSS: 0.54%higher than 43% of CVEs
Weakness (CWE): CWE-352Cross-Site Request Forgery (CSRF)
KEV status: Not in KEV
Published: 12 Jul 2023
Updated: 8 Apr 2026
Ecosystem: Git repositories
Assigned by (CNA): Wordfence

Summary

Source: GitHub Advisory Database

The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Medium4.3Base score from GitHub Advisory Database

Attack Vector AV: Network
Attack Complexity AC: Low
Privileges Required PR: None
User Interaction UI: Required
Scope S: Unchanged
Confidentiality C: None
Integrity I: Low
Availability A: None

CISA SSVC decision points

Exploitation: none; No public exploitation evidence
Automatable: no; Needs manual steps per target
Technical impact: partial; Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (CVE record)

https://github.com/wpexpertsio/post-smtp
Git repositories
pkg:github/wpexpertsio/post-smtp
Affected versions
<= 2.0.20
Fixed in
None after 2.0.20
Show 26 listed versions
- 2.0.20
- 2.0.19
- 2.0.18
- 2.0.17
- 2.0.16
- 2.0.15
- 2.0.14
- 2.0.13
- 2.0.12
- 2.0.11
- 2.0.10
- 2.0.9

Package	Affected versions	Fixed in
https://github.com/wpexpertsio/post-smtp Git repositories `pkg:github/wpexpertsio/post-smtp`	<= 2.0.20 Show 26 listed versions 2.0.20 2.0.19 2.0.18 2.0.17 2.0.16 2.0.15 2.0.14 2.0.13 2.0.12 2.0.11 2.0.10 2.0.9	None after 2.0.20

Fix

Source: OSV (CVE record)

No fixed version has been published

Every version in the affected ranges above is vulnerable. Look for mitigations in the advisory and references, and watch the vendor for a release.

Vulnerability intelligence

References

Fixes 1

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2473579%40post-smtp&new…

Advisories 10

Credits

Jerome Bruandetfinder

Questions about CVE-2021-4422

What is the GHSA ID for CVE-2021-4422?: GitHub tracks CVE-2021-4422 as GHSA-7qhm-w96c-j5vq.
What is the CVSS score of CVE-2021-4422?: CVE-2021-4422 has a CVSS 3.1 base score of 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Which versions are affected by CVE-2021-4422?: https://github.com/wpexpertsio/post-smtp (GIT): <= 2.0.20.
How do I fix CVE-2021-4422?: No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.
What is the Package URL (PURL) for CVE-2021-4422?: The affected package's PURL is pkg:github/wpexpertsio/post-smtp.
Is CVE-2021-4422 exploited in the wild?: CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-4422. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

Data sources

Upstream records

OSV (GitHub advisory)No record
GitHub Advisory DatabaseLoadedRaw JSON
OSV (CVE record)LoadedRaw JSON
CVE.orgLoaded
CISA KEV catalogLoaded

Fetched 5 days ago (8 Oct 2026, 13:05 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description: GitHub Advisory Database
Severity score: GitHub Advisory Database
Weakness (CWE): GitHub Advisory Database
Affected packages: OSV (CVE record)
Fix: OSV (CVE record)
References: Computed by CVEminer
SSVC: CVE.org
KEV status: CISA KEV catalog
EPSS: GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.