Post SMTP < 3.6.1 - Account Takeover via Unauthenticated Email Log Disclosure

Description

The plugin is vulnerable to unauthorized access of data due to a missing capability check on the __construct function. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.