CVE-2026-18437 mailerpress CVE debrief

Who should care

WordPress administrators and users of the MailerPress plugin, especially those with sensitive contact information, should be aware of this vulnerability and take steps to verify their plugin version and implement additional security measures. This includes reviewing contact details for unauthorized changes, enhancing authentication and authorization controls, and monitoring for suspicious activity.

Technical summary

The MailerPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerpress/v1/contact` endpoint in all versions up to, and including, 1.5.0. This allows unauthenticated attackers to update contact details. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The issue was reported by [email protected] and is documented in the NVD and CVE records.

Defensive priority

Medium priority due to potential for data manipulation

Recommended defensive actions

• Verify MailerPress plugin version and update to latest if vulnerable
• Implement additional monitoring for suspicious contact updates
• Review and enhance authentication and authorization controls for WordPress
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The MailerPress plugin for WordPress has a vulnerability allowing unauthorized access to update contact details due to a missing capability check. This issue affects all versions up to and including 1.5.0. Evidence from the NVD and Wordfence indicates a vulnerability in MailerPress plugin versions up to 1.5.0. Further verification is needed to determine full scope. Defenders should verify the version of the MailerPress plugin in use, review contact details for unauthorized changes, and implement additional monitoring for suspicious activity.

Official resources