CVE-2026-18437
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The MailerPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access due to a missing capability check on the REST API endpoint `mailerpress/v1/contact`. This allows unauthenticated attackers to update contact details.
Risk Assessment
An attacker can modify contact details without authorization, potentially leading to data integrity issues and phishing attacks.
Recommendation
Update the MailerPress plugin to the latest patched version.
Other vulnerabilities in MailerPress
See all- CVE-2026-57410High
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
- CVE-2026-8599Medium
The MailerPress plugin for WordPress up to version 2.0.4 is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. The public campaign preview endpoint (/mp-email/{id}-slug/) is not affected due to a Content-Security-Policy header blocking inline scripts; exploitation is limited to the admin dashboard preview.
Original NVD description (English source)
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerpress/v1/contact` endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update contact details.