CVE-2026-18436 in MailPress Plugin
Summary
by MITRE • 07/31/2026
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). The route in the vulnerable range was registered without a permissionCallback, allowing the restoreRevision() handler to run for unauthenticated requests and overwrite a campaign's content_html with any prior revision. This makes it possible for unauthenticated attackers to modify campaign content by restoring an arbitrary revision.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in the MailPress plugin for WordPress represents a critical authorization flaw that undermines the security posture of affected installations. This issue specifically affects versions up to and including 1.5.0, where the REST endpoint designed for campaign revision restoration lacks proper authentication controls. The vulnerable route at POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id> was registered without a permissionCallback mechanism, creating an unauthorized access vector that allows any attacker to manipulate campaign content regardless of their authentication status.
The technical implementation of this vulnerability stems from the absence of proper access control validation within the MailPress plugin's REST API framework. When an attacker makes a request to the restore-revision endpoint, the system fails to verify whether the requester possesses appropriate privileges to perform such operations. This omission enables the restoreRevision() handler to execute without authentication checks, allowing malicious actors to overwrite campaign content_html fields with data from any previous revision stored in the system's revision history.
The operational impact of this vulnerability extends beyond simple data modification, as it provides attackers with the capability to inject arbitrary content into email campaigns that may be delivered to end users. This poses significant risks including potential phishing attacks, malicious content distribution, and compromise of campaign integrity. The ability to restore any revision means attackers can potentially revert campaigns to versions containing compromised content or introduce malicious payloads that could affect recipient trust and brand reputation.
Organizations running vulnerable MailPress installations face substantial security risks as this vulnerability enables unauthorized modification of email marketing content without requiring any valid credentials or authentication tokens. The attack surface is particularly concerning because email campaigns often contain sensitive information and may be used for business-critical communications, making the potential damage from content manipulation significant. This vulnerability aligns with CWE-284 (Improper Access Control) and can be categorized under ATT&CK technique T1078 (Valid Accounts) when attackers leverage the lack of proper authentication controls to gain unauthorized access to campaign management functionality.
Mitigation strategies should focus on immediate plugin updates to versions that address this authorization flaw, as well as implementing additional security measures such as restricting REST API access through firewall rules or authentication proxies. Administrators should also review and audit existing campaign content for any potential compromise, while ensuring proper access controls are implemented at the web server level to prevent unauthorized access to sensitive endpoints. Regular security monitoring and vulnerability scanning of WordPress installations remain essential practices to identify and remediate similar authorization issues before they can be exploited by malicious actors.