CVE-2024-9511

Deeper analysis

The FluentSMTP WordPress plugin, which integrates with providers such as Amazon SES, SendGrid, MailGun, Postmark, and Google SMTP, is affected by a PHP Object Injection vulnerability (CWE-502) in all versions through 2.2.82. The flaw stems from unsafe deserialization of untrusted input inside the formatResult function of the Logger.php component, allowing an attacker to supply a serialized PHP object without authentication.

An unauthenticated remote attacker can exploit the issue over the network by sending crafted input that triggers object injection. Although no POP chain exists in the plugin itself, the presence of an additional vulnerable plugin or theme on the same site could enable the attacker to delete arbitrary files, access sensitive data, or achieve remote code execution, consistent with the CVSS 9.8 rating.

The Wordfence advisory and WordPress plugin trac changesets indicate that the vulnerability received a partial fix in version 2.2.82, with further remediation applied in subsequent changesets 3194359 and 3194555; administrators are advised to update immediately and verify that no other plugins introduce usable POP chains.

EPSS for this CVE rose from a low baseline to a peak of 0.0787 on 2025-12-11 before receding to the current value of 0.0263, indicating a noticeable increase in exploitation interest after disclosure.