CVE-2026-18437 in MailerPress Plugin
Summary
by MITRE • 07/31/2026
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerpress/v1/contact` endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update contact details.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/31/2026
The MailerPress WordPress plugin presents a critical authorization vulnerability that undermines the security of email marketing operations through an insufficient capability check implementation. This flaw exists within the REST API endpoint at mailerpress/v1/contact which fails to properly validate user permissions before processing contact update requests. The vulnerability affects all versions up to and including 1.5.0, creating a persistent risk for WordPress sites that rely on this plugin for newsletter management and customer communication. Attackers can exploit this weakness without requiring authentication credentials, fundamentally compromising the integrity of contact data within the system.
The technical implementation flaw stems from the absence of proper capability verification within the API endpoint's access control mechanism. When requests are made to the mailerpress/v1/contact endpoint, the plugin fails to confirm whether the requesting entity possesses the necessary permissions to modify contact information. This missing validation creates an unauthorized access vector that allows any external party to manipulate email subscriber details including names, email addresses, and associated metadata. The vulnerability aligns with CWE-863, which specifically addresses "Incorrect Authorization" conditions where access control checks are improperly implemented or missing from security-critical functions.
The operational impact of this vulnerability extends beyond simple data manipulation to potentially compromise entire email marketing campaigns and customer relationships. Unauthenticated attackers can modify contact details to redirect communications, create false subscriber entries, or disrupt legitimate mailing lists that organizations depend upon for business operations. This weakness particularly affects organizations using the plugin's AI automation features where contact data integrity is crucial for personalized communication workflows. The vulnerability represents a significant risk to data privacy and regulatory compliance, especially in environments subject to gdpr or other data protection regulations.
Security mitigation strategies should prioritize immediate plugin updates to versions that address the capability check deficiency, though this requires careful testing to prevent service disruption. Organizations should implement additional network-level controls such as api rate limiting and access restriction policies to limit exposure while patches are deployed. The vulnerability demonstrates the importance of proper input validation and access control implementation within WordPress REST API endpoints, aligning with ATT&CK technique T1078 004 for Valid Accounts and T1566 002 for Phishing, as attackers can leverage this weakness to gain unauthorized access to marketing data. System administrators should also consider implementing monitoring solutions that detect unusual contact update patterns and establish network segmentation to limit the potential damage from such exploitation attempts.