Mailjet Email Marketing EUVD-2026-93035

No special conditions beyond having the Mailjet Email Marketing WordPress plugin version 6.2.3 or earlier installed and network-reachable - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with no user interaction against the plugin's default behavior. The principal limiting factor is product scope: only sites running this specific plugin at or below version 6.2.3 are affected, and the impact is confined to confidentiality (disclosure of sensitive information), with no integrity or availability effect. The exact feature or endpoint that leaks the data is not detailed in the available sources and should be confirmed against the Patchstack advisory.

This is a moderate-severity (CVSS 5.3) information disclosure flaw in the Mailjet Email Marketing WordPress plugin (<= 6.2.3), classified as CWE-201 (insertion of sensitive information into sent data). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-based, low-complexity, unauthenticated exploitation with no user interaction, which is a genuinely favorable attack profile for an adversary. However, impact is limited to confidentiality only (C:L/I:N/A:N), scope is unchanged, and the disclosed data is 'sensitive' but not full compromise - there is no integrity or availability effect. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The signals are internally consistent (vector matches an unauthenticated info-leak), so this is not a case of a high CVSS masking low real risk - but it is a low-to-moderate priority: easy to exploit yet limited blast radius, best treated as a patch-in-normal-cycle issue unless the exposed data (e.g., API keys or subscriber PII) proves highly sensitive, which the terse description does not specify. The exact nature of the leaked data is UNKNOWN from available sources and should be verified against the Patchstack advisory.

A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running the vulnerable Mailjet Email Marketing plugin and retrieves sensitive information exposed by the plugin without needing credentials or user interaction. No public exploit code was identified in the provided data, but the low attack complexity (AC:L) means exploitation would be straightforward if the vulnerable endpoint is known. The disclosed data could include configuration details, API credentials, or subscriber information, aiding further targeting.