What is the CVSS score of EUVD-2026-51506?

EUVD-2026-51506 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

MailerPress EUVD-2026-51506

| CVE-2026-18437 MEDIUM

Missing Authorization (CWE-862)

2026-07-31 Wordfence

GHSA-gjcp-gv56-hccw

WordPress Authentication Bypass Mailerpress Wordpress Plugin Mailerpress Newsletter Email Marketing Ai Automation

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

PR:N confirmed by complete absence of capability check; I:L only as impact is restricted to contact record writes with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 09:51 vuln.today

CVE Published

Jul 31, 2026 - 08:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

The MailerPress - Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update contact details.

AnalysisAI

Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint mailerpress/v1/contact. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.

Technical ContextAI

MailerPress is a WordPress plugin providing newsletter, email marketing, and AI-driven automation features. WordPress plugins expose functionality via the WP REST API by registering endpoints with optional permission callbacks; omitting or misconfiguring that callback (CWE-862: Missing Authorization) means any caller - authenticated or not - can invoke the endpoint. The vulnerable code is identified in src/Api/Contacts.php at lines L801 and L847 (WordPress plugin Trac), where the mailerpress/v1/contact route is registered without a permission_callback enforcing any WordPress capability (e.g., manage_options or edit_posts). The affected CPE is cpe:2.3:a:mailerpress:mailerpress_-_newsletter,_email_marketing_&_ai_automation:*:*:*:*:*:*:*:*, covering all versions through 1.5.0.

RemediationAI

Update the MailerPress plugin to a version beyond 1.5.0 once a patched release is published by the vendor. The upstream code change is traceable to src/Api/Contacts.php lines L801 and L847 in the WordPress plugin Trac repository (https://plugins.trac.wordpress.org/browser/mailerpress/trunk/src/Api/Contacts.php), but no exact patched release version is confirmed from the available data - verify the WordPress.org plugin repository for an updated release. As an interim compensating control, administrators can use a web application firewall (e.g., Wordfence, Cloudflare WAF) to block unauthenticated POST/PUT requests to the /wp-json/mailerpress/v1/contact endpoint; note this may break legitimate front-end contact form submissions if the plugin design relies on unauthenticated REST calls. Alternatively, disabling the plugin entirely until a patch is confirmed eliminates the attack surface with the trade-off of losing newsletter functionality.