Executive brief
The MailPress plugin for WordPress, which is used for managing email marketing and newsletters, contains a security flaw that allows unauthorized users to modify email campaigns. By exploiting this vulnerability, an attacker can revert a campaign's content to a previous version without needing to log in. This could lead to the distribution of outdated or incorrect information to subscribers, potentially damaging a company's reputation or marketing efforts.
Technical details
The MailPress plugin for WordPress fails to implement a permissionCallback on its campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). This missing authorization check allows the restoreRevision() handler to be executed by unauthenticated network requests. An attacker can exploit this to overwrite a campaign's current 'content_html' with any existing prior revision. The vulnerability is classified as CWE-862 (Missing Authorization) and affects all versions up to and including 1.5.0.
Affected products
- mailerpress MailPress (MailerPress – Newsletter, email marketing & AI automation) <= 1.5.0
Timeline
- 2026-07-31: disclosed: Vulnerability disclosed by Wordfence and published in NVD