More than 200,000 WordPress websites are at risk due to a vulnerability in the Post SMTP plugin that allows low-privileged users to hijack administrator accounts. The flaw, identified as CVE-2025-24000, stems from inadequate permission checks in the plugin's REST API, enabling unauthorized access to sensitive email logs. Although a fix was released in version 3.3.0, many users have yet to update, leaving them exposed to potential attacks.