EUVD-2026-45890
GHSA-h2v3-9w9f-v798
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no privileges (PR:N) but admin must be socially engineered (UI:R); impact is limited to config loss and plugin deactivation with no data exfiltration.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Articles & Coverage 1
AnalysisAI
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the MailerSend WordPress plugin version prior to 1.0.8 is installed and active on the target site, (2) a WordPress user holding the manage_options capability (site administrator) is logged into the admin panel in an active browser session, and (3) the attacker successfully social-engineers that administrator into visiting a crafted malicious URL or page - for example, via a phishing email, forum post, or malicious advertisement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L accurately reflects the attack profile: network-reachable, low complexity, no attacker privileges required, but mandatory user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a webpage containing an auto-submitting HTML form or zero-pixel image tag targeting the MailerSend plugin's configuration-delete endpoint on the victim's WordPress site. The attacker delivers a link to this page via a phishing email or social media message to a site administrator. … |
| Remediation | Upgrade the MailerSend WordPress plugin to version 1.0.8 or later, which is confirmed available from the vendor and resolves the missing nonce check on the configuration-delete action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today