What is the CVSS score of CVE-2026-57626?

CVE-2026-57626 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of MailPoet are affected by CVE-2026-57626?

MailPoet WordPress plugin (versions 5.30.0-5.33.0) contains a cross-site request forgery vulnerability (CVSS 7.1) that could allow attackers to manipulate email campaigns, subscriber management, and…

How to fix or mitigate CVE-2026-57626?

Within 24 hours, inventory all WordPress installations and identify those running MailPoet versions 5.30.0-5.33.0. Within 7 days, implement compensating controls: restrict WordPress administrative backend access by IP range, enforce two-factor authentication for all administrative accounts, deploy Web Application Firewall CSRF token protections, and establish a temporary security advisory to administrators to avoid clicking untrusted links while logged into WordPress. Within 30 days, subscribe to MailPoet's security channel for patch announcements, establish a testing plan for migration to patched versions as they become available, and evaluate alternative email marketing plugins if a patch is not released within 60 days.

MailPoet CVE-2026-57626

EUVD-2026-48248 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 audit@patchstack.com

GHSA-fp5m-jrmh-93h3

WordPress CSRF Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered CSRF needs no attacker privileges (PR:N) but a logged-in victim's interaction (UI:R); forged action changes state beyond the component (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:59 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery.

This issue affects MailPoet: from 5.30.0 through 5.33.0.

AnalysisAI

Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.

Technical ContextAI

MailPoet is a popular WordPress newsletter and email-marketing plugin that adds AJAX and admin-post endpoints to the WordPress site. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of these state-changing endpoints do not properly validate a WordPress nonce or other anti-CSRF token, so the server cannot distinguish a legitimate request originating from the plugin UI from a forged one crafted by a third-party site. Because WordPress relies on cookie-based session authentication, a browser will automatically attach the victim's authentication cookies to a cross-origin request, letting the forged action execute with the victim's privileges. The CVSS scope change (S:C) indicates the forged action can affect resources beyond the vulnerable component's initial security context, consistent with plugin actions that alter broader WordPress state.

RemediationAI

Upgrade MailPoet to a fixed release above 5.33.0 as published by the vendor; the exact patched version is not stated in the provided intelligence, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mailpoet/vulnerability/wordpress-mailpoet-plugin-5-30-0-5-33-0-cross-site-request-forgery-csrf-vulnerability) and the MailPoet changelog to confirm the specific patched build before updating. Because the flaw is CSRF, effective compensating controls until patching include deploying a Web Application Firewall rule that enforces WordPress nonce/referer validation on MailPoet admin-post and AJAX actions (trade-off: may block some legitimate integrations), restricting access to the WordPress admin area by IP allowlisting or VPN so that only trusted networks can reach the vulnerable endpoints (trade-off: hampers remote administration), and instructing administrators to log out of wp-admin when not actively working and avoid clicking untrusted links while authenticated (trade-off: operational friction, not a technical control). Patch status: released patched version not independently confirmed from the provided data - verify the fix version with the vendor advisory.