CVE-2026-105055 in WP Mailster Plugin
Summary
by MITRE • 10/05/2026
Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The identified security flaw resides within the WP Mailster plugin, a widely utilized tool for managing email marketing campaigns and subscriber lists on WordPress-based websites. This vulnerability is classified as an improper access control issue, specifically falling under CWE-285 which denotes Improper Authorization. The core technical deficiency involves missing or incorrectly implemented authorization checks in certain administrative endpoints exposed by the plugin. These endpoints are designed to handle sensitive operations such as managing email templates, subscriber data, and campaign configurations. Due to the absence of robust server-side validation for user privileges, an attacker who has obtained valid credentials with even minimal access levels can manipulate these parameters to perform actions that should be restricted to administrators or higher-privileged roles. This breakdown in security logic allows for unauthorized modification of critical plugin settings and potentially sensitive subscriber information.
From a technical perspective, the vulnerability stems from the application's failure to verify whether the authenticated user possesses the necessary permissions before executing state-changing requests. In many WordPress plugins, this often manifests as missing checks against capabilities like manage_options or specific custom roles defined by the plugin itself. When an attacker sends crafted HTTP requests to these endpoints, the server processes them without confirming if the session belongs to a privileged account. This allows for actions such as altering email template content, exporting subscriber lists containing personally identifiable information, or modifying campaign settings that could disrupt service availability. The impact is significant because it compromises both confidentiality and integrity of the data managed by the plugin. Attackers can exfiltrate valuable marketing leads or deface public-facing communications depending on their level of access and intent.
The operational impact extends beyond immediate data theft to include potential reputational damage and regulatory compliance violations. Since WP Mailster handles email lists, it often processes personal data subject to regulations such as GDPR in Europe or CCPA in California. Unauthorized access could lead to the exposure of subscriber emails and associated metadata, resulting in legal liabilities for website owners. Furthermore, if an attacker modifies campaign settings, they could send malicious content under the organization's name, leading to blacklisting by email providers and loss of trust among legitimate subscribers. The vulnerability affects versions from n/a through 1.9.0.0, meaning a large installed base may be at risk until patches are applied or workarounds are implemented.
Mitigation strategies should prioritize immediate patching if an updated version is available that addresses the authorization checks. For environments where updating is not immediately feasible, administrators can implement several defensive measures. First, restricting access to the WordPress admin area via IP whitelisting using web application firewalls or server configuration files like .htaccess can limit exposure to known malicious sources. Second, enforcing strong password policies and multi-factor authentication reduces the likelihood of credential compromise that precedes exploitation. Additionally, auditing plugin code for similar patterns in other endpoints is advisable as this flaw may indicate broader architectural weaknesses in access control implementation within the plugin's design. Security teams should also monitor server logs for unusual POST requests to WP Mailster-specific URLs which could indicate active probing or exploitation attempts aligned with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass authentication controls and move laterally or escalate privileges within the application environment.