MailerPress Plugin CVE-2026-18436

The MailerPress - Newsletter, Email Marketing & AI Automation plugin must be installed and active on a WordPress site at version 1.5.0 or earlier. The WordPress REST API must be publicly reachable over the network, which is the default configuration for WordPress installations. No authentication is required - the CVSS vector PR:N confirms this is exploitable by unauthenticated remote attackers. The attacker must supply a valid campaign ID and a valid revision ID for that campaign; guessing or enumerating these IDs is the only practical barrier, and they are sequential integers in typical WordPress post ID schemes. Exploitation is limited to integrity modification of campaign HTML content only - no server-side execution, no data theft, and no denial of service are possible through this vector.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N correctly characterizes this as network-accessible, zero-complexity, unauthenticated exploitation with low integrity impact and no confidentiality or availability consequence, yielding a score of 5.3 (Medium). Real-world risk is modest but concrete: an attacker who can enumerate or guess campaign and revision IDs can silently revert or corrupt campaign content, potentially re-introducing previously removed malicious or outdated messaging before a scheduled send. The scope is constrained to campaign HTML - no data exfiltration, no server-side code execution, no service disruption. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified from probabilistic modeling. The absence of KEV listing and no identified POC further deprioritize this relative to critical-severity issues, but the zero-prerequisite attack vector means any internet-facing site running ≤1.5.0 is exposed without any additional attacker capability.

An attacker identifies a WordPress site running MailerPress ≤1.5.0 - trivially discoverable via WordPress plugin enumeration or passive scanning. They enumerate a valid campaign ID (potentially visible in the WordPress admin URL structure if any prior access exists, or via brute-force against the REST API) and craft a POST request to /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id> without any authentication header. The server executes restoreRevision() and overwrites the live campaign HTML with the targeted revision, silently corrupting scheduled email content ahead of a send. No public exploit code has been identified at time of analysis.