Executive brief
The MailerSend plugin for WordPress, which handles website email delivery via SMTP, is vulnerable to an attack that can wipe its settings. By tricking a logged-in administrator into clicking a malicious link, an attacker can remotely delete the plugin's configuration and deactivate it. This results in a total failure of the website's ability to send emails, such as password resets or contact form notifications.
Technical details
The MailerSend WordPress plugin fails to implement nonce (CSRF token) validation on the 'mailer_delete' action within the configuration page. While the plugin correctly checks for the 'manage_options' capability, the lack of a nonce allows an unauthenticated attacker to perform a Cross-Site Request Forgery (CSRF) attack. By inducing an authenticated administrator to visit a specially crafted URL or submit a hidden form, the attacker can trigger the deletion of the plugin's SMTP configuration and force the plugin to deactivate. This vulnerability is fixed in version 1.0.8.
Affected products
- MailerSend MailerSend – Official SMTP Integration < 1.0.8
Timeline
- 2026-06-29: disclosed: Publicly published by WPScan
- 2026-07-20: advisory: NVD published date