WP Mailster CVE-2026-105055

The only prerequisite derivable from the data is that a vulnerable WP Mailster installation (any version up to and including 1.9.0.0) be deployed and network-reachable; per CVSS PR:N/UI:N/AC:L, exploitation requires no authentication, no user interaction, and no special configuration against a default install. The description references 'Incorrectly Configured Access Control Security Levels,' indicating the flaw stems from an access-control check that is missing or too permissive on a plugin function/endpoint, but it does not name the exact feature. The practical limiting factor is impact, not access: only low-level confidentiality is affected (C:L, I:N, A:N), so a successful attack yields unauthorized information/function access rather than data modification or site takeover.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a vendor/NVD CVSS 3.1 score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning network-reachable, low-complexity, unauthenticated access with only low confidentiality impact and no integrity or availability effect - consistent with unauthorized read access to data/functionality that should be protected, not full compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore limited to the CVSS vector alone. The combination of easy, unauthenticated network access (PR:N/AC:L) but only C:L impact places this as a lower-priority information-exposure issue rather than a critical RCE-class bug. Key limiting data is missing: EPSS probability is absent (cannot gauge likelihood of exploitation) and no POC status is confirmed, so prioritization should lean on the modest confidentiality-only impact - patch in routine cycles rather than as an emergency.

A remote, unauthenticated attacker sends a direct request to a WP Mailster plugin endpoint or AJAX/REST action that fails to enforce an authorization check, retrieving information or invoking functionality intended only for privileged users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is required, but impact is limited to low-level confidentiality disclosure. No public proof-of-concept was identified in the provided data.