Executive brief
A vulnerability exists in MailerPress, a WordPress plugin used for email marketing and newsletter automation. Due to a security flaw, unauthorized individuals can modify contact information within the system without needing to log in. This could lead to the corruption of marketing databases or unauthorized changes to subscriber details, potentially impacting the integrity of customer communication lists.
Technical details
The MailerPress plugin for WordPress (versions up to and including 1.5.0) suffers from a missing authorization vulnerability (CWE-862) within its REST API implementation. Specifically, the `mailerpress/v1/contact` endpoint fails to perform adequate capability checks on incoming requests. This allows an unauthenticated remote attacker to send crafted HTTP requests to the vulnerable endpoint to update contact details. The vulnerability is rooted in the `src/Api/Contacts.php` file where the permission callback is either missing or insufficient. While the impact is limited to data integrity (unauthorized updates) rather than data theft or full site takeover, it poses a risk to the accuracy of the plugin's contact management system.
Affected products
- mailerpress MailerPress – Newsletter, email marketing & AI automation 0 - 1.5.0
Timeline
- 2026-07-31: disclosed: Initial disclosure by Wordfence and NVD publication