# CVE-2021-4422: POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass

> CVE-2021-4422 (GitHub advisory GHSA-7qhm-w96c-j5vq) is a medium-severity vulnerability with a CVSS 3.1 base score of 4.3, classed as Cross-Site Request Forgery (CSRF) (CWE-352), in github.com/wpexpertsio/post-smtp (Git repository). Affected versions: <= 2.0.20. No fixed version has been published yet.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2021-4422

| Field | Value |
| --- | --- |
| CVE | CVE-2021-4422 |
| GHSA | GHSA-7qhm-w96c-j5vq |
| Severity | Medium |
| CVSS 3.1 | 4.3 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N` (GitHub Advisory Database) |
| CWE | CWE-352 Cross-Site Request Forgery (CSRF) |
| EPSS | 0.54% (higher than 43% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 12 Jul 2023 |
| Modified | 8 Apr 2026 |

## Description

The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| https://github.com/wpexpertsio/post-smtp | GIT | `pkg:github/wpexpertsio/post-smtp` | <= 2.0.20 | no fix |

## Questions

**What is the GHSA ID for CVE-2021-4422?**

GitHub tracks CVE-2021-4422 as GHSA-7qhm-w96c-j5vq.

**What is the CVSS score of CVE-2021-4422?**

CVE-2021-4422 has a CVSS 3.1 base score of 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

**Which versions are affected by CVE-2021-4422?**

https://github.com/wpexpertsio/post-smtp (GIT): <= 2.0.20.

**How do I fix CVE-2021-4422?**

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

**What is the Package URL (PURL) for CVE-2021-4422?**

The affected package's PURL is pkg:github/wpexpertsio/post-smtp.

**Is CVE-2021-4422 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2021-4422. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 43% of CVEs.

## References

- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2473579%40post-smtp&new=2473579%40post-smtp&sfp_email=&sfph_mail= (fix)
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ (advisory)
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ (advisory)
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ (advisory)
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ (advisory)
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ (advisory)
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ (advisory)
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ (advisory)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=cve (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2021-4422 (advisory)
- https://github.com/advisories/GHSA-7qhm-w96c-j5vq (advisory)

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2021-4422), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.