alert http any any -> $HOME_NET any (
msg:"ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)";
flow:established,to_server;
http.uri;
content:"page|3d|postman_email_log"; fast_pattern;
content:"view|3d|log";
content:"log_id|3d|";
reference:url,www.wordfence.com/blog/2025/11/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-post-smtp-wordpress-plugin/;
reference:cve,2025-11833;
classtype:web-application-attack;
sid:2065685; rev:2;
metadata:affected_product Wordpress_Plugins, attack_target Server, tls_state TLSDecrypt, created_at 2025_11_06, cve CVE_2025_11833, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_06_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
target:dest_ip;
)