EUVD-2026-45890
GHSA-h2v3-9w9f-v798
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no privileges (PR:N) but admin must be socially engineered (UI:R); impact is limited to config loss and plugin deactivation with no data exfiltration.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Articles & Coverage 1
AnalysisAI
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
Technical ContextAI
The vulnerability resides in the MailerSend WordPress plugin's configuration-delete action handler. WordPress uses cryptographic nonces - time-limited tokens tied to the authenticated user session - to protect state-changing admin actions from cross-origin request forgery (CWE-352). The affected handler correctly checks that the requesting user holds the manage_options capability (i.e., is an administrator), but then fails to call wp_verify_nonce() or check_admin_referer(), leaving the action exposed to forged requests originating from any origin. Because browsers automatically include session cookies with cross-site requests, an attacker-controlled page can silently trigger the delete action using the victim admin's authenticated session. The CPE identifier cpe:2.3:a:unknown:mailersend:*:*:*:*:*:*:*:* covers all plugin versions prior to 1.0.8.
RemediationAI
Upgrade the MailerSend WordPress plugin to version 1.0.8 or later, which is confirmed available from the vendor and resolves the missing nonce check on the configuration-delete action. The WPScan advisory at https://wpscan.com/vulnerability/595e653d-0904-43cf-8e61-d684599de11b/ is the authoritative source for patch confirmation. If immediate upgrade is blocked, restrict WordPress admin panel access to trusted IP ranges at the web server or firewall level - this prevents the forged request from reaching the vulnerable endpoint even if the admin is tricked, though it adds operational overhead for remote administrators. Administrators should also avoid clicking unsolicited links while logged into the WordPress dashboard until the patch is applied. Temporarily deactivating the plugin eliminates the attack surface entirely but at the cost of all plugin-provided email delivery; sites relying on MailerSend for transactional email must weigh this trade-off carefully.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today