CVE-2026-57410
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
Risk Assessment
The risk involves potential takeover of administrator accounts or execution of unauthorized operations, which could compromise the confidentiality and integrity of organizational data.
Recommendation
Immediately update the MailerPress plugin to the latest available version that fixes this vulnerability. Also review privilege configurations and restrict access to the admin panel.
Other vulnerabilities in MailerPress
See all- CVE-2026-18437Medium
The MailerPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access due to a missing capability check on the REST API endpoint `mailerpress/v1/contact`. This allows unauthenticated attackers to update contact details.
- CVE-2026-8599Medium
The MailerPress plugin for WordPress up to version 2.0.4 is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. The public campaign preview endpoint (/mp-email/{id}-slug/) is not affected due to a Content-Security-Policy header blocking inline scripts; exploitation is limited to the admin dashboard preview.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Privilege Escalation.This issue affects MailerPress: from n/a through <= 2.0.2.