MailerPress CVE-2026-18437

The MailerPress plugin must be installed and activated on a WordPress site running version 1.5.0 or earlier. The WordPress REST API must be publicly accessible, which is the default configuration on all standard WordPress installations - no special configuration is required by the attacker. No authentication, user interaction, elevated privileges, or non-default settings are needed; the mailerpress/v1/contact endpoint accepts requests from any unauthenticated network client. Exploitation is limited to modification of contact records - it does not enable data exfiltration, remote code execution, or denial of service, which bounds the blast radius for defenders assessing triage priority.

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the risk profile: network-reachable with no prerequisites, but impact is bounded to limited integrity loss (contact record manipulation) with no confidentiality or availability consequence. No EPSS data was provided in the intelligence feed; however, the low attack complexity and zero-authentication requirement imply a higher practical exploitability than many Medium-scored vulnerabilities. There is no KEV listing and no known public exploit, suggesting this has not yet attracted automated exploitation campaigns. The real-world impact is constrained - an attacker can corrupt or overwrite contact details in the plugin's email list but cannot extract data, execute code, or disrupt availability. Priority should be moderate: patch promptly, but this does not warrant emergency response unless the site relies heavily on contact list integrity for business operations.

An attacker enumerates WordPress REST API routes on a target site and discovers the publicly accessible /wp-json/mailerpress/v1/contact endpoint. Without any credentials or prior access, they send a crafted HTTP request with a modified contact payload, successfully overwriting contact details in the email marketing database. No public exploit code has been identified at time of analysis, but the simplicity of a missing permission check means any HTTP client or automated scanner can exploit this with minimal effort.