MailerPress EUVD-2026-43482

Exploitation requires the attacker to already hold a valid authenticated WordPress account on the target site (CVSS PR:L), so the practical prerequisite is either an existing low-privilege account or a site configured to permit open user self-registration; no user interaction and no elevated privileges are needed beyond that initial login. The specific limiting factors are: the site must run MailerPress version 2.0.2 or earlier with the plugin active, and the attacker must be able to reach the WordPress admin-ajax/REST interface over the network (AV:N/UI:N). On sites that disable self-registration and tightly control account provisioning, obtaining that initial low-privilege account is the main barrier to exploitation.

The reported CVSS base score is 8.8 (High), driven by network vector, low complexity, no user interaction, and only low privileges required - meaning any authenticated account (potentially a self-registered subscriber on sites allowing open registration) can exploit it, and the S:U/C:H/I:H/A:H metrics imply full compromise of the plugin's protected scope or the site. Offsetting this, no EPSS score was supplied, the vulnerability is not in CISA KEV, and no public proof-of-concept was referenced, so there is no evidence of active or automated exploitation yet. The realistic priority hinges on the PR:L requirement for a valid low-privilege account: on sites that permit user self-registration this is a high-priority patch, whereas on closed sites the attacker must first obtain any authenticated foothold. Whether impact is site-wide takeover or plugin-only cannot be fully confirmed from the available data - verify against the Patchstack advisory.

An attacker registers or obtains a low-privilege WordPress account (e.g., subscriber) on a site running MailerPress <= 2.0.2, then invokes the vulnerable plugin action that lacks a proper capability check to assign themselves elevated privileges. With administrative-level access they can install malicious plugins, modify content, or exfiltrate data, achieving full site compromise. No public proof-of-concept was referenced, so exploitation would require the attacker to independently identify the affected endpoint.