What is the CVSS score of EUVD-2026-51507?

EUVD-2026-51507 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

MailerPress Plugin EUVD-2026-51507

| CVE-2026-18436 MEDIUM

Missing Authorization (CWE-862)

2026-07-31 Wordfence

GHSA-vfgx-g9m5-wfgv

WordPress Authentication Bypass Mailerpress Wordpress Plugin Mailerpress Newsletter Email Marketing Ai Automation

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

REST endpoint is network-accessible with no auth required (PR:N); only campaign HTML content is modified (I:L), with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 09:51 vuln.today

CVE Published

Jul 31, 2026 - 08:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). The route in the vulnerable range was registered without a permissionCallback, allowing the restoreRevision() handler to run for unauthenticated requests and overwrite a campaign's content_html with any prior revision. This makes it possible for unauthenticated attackers to modify campaign content by restoring an arbitrary revision.

AnalysisAI

Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.

Technical ContextAI

MailerPress is a WordPress plugin providing newsletter and AI-driven email marketing automation, identified by CPE cpe:2.3:a:mailerpress:mailerpress_-_newsletter,_email_marketing_&_ai_automation:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-862 (Missing Authorization), a structural flaw where a code path that modifies state is reachable without an authorization check. In WordPress, REST API routes are registered via register_rest_route(); each route should supply a permission_callback argument that evaluates whether the requesting user has sufficient rights. The vulnerable CampaignRevisions handler at src/Api/CampaignRevisions.php (lines 155-156) registered the restore-revision route without this callback, causing WordPress to fall back to permitting public access. The restoreRevision() function then runs unconditionally, accepting attacker-supplied campaign and revision IDs and persisting the chosen revision's content_html as the campaign's current body.

RemediationAI

The primary remediation is to update MailerPress beyond version 1.5.0 once a patched release is published by the vendor; monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/793a7ef0-8938-47a6-80ed-83f69fbbb27f for a confirmed fix version. No exact patched version number is available from the current intelligence sources. As an interim compensating control, administrators can block the specific REST namespace at the web server or WAF layer by denying POST requests matching the path pattern /wp-json/mailpress/v1/campaign/*/restore-revision/*; this eliminates the exposed endpoint entirely but disables the revision-restore feature for legitimate users as well. Alternatively, a WAF rule requiring authentication headers (e.g., WordPress nonce or cookie validation) on that path can restrict access to logged-in users without disabling the feature globally. Wordfence firewall users with an active subscription may receive a rule covering this route before an official plugin patch is available.