Mailerpress
Monthly
Privilege escalation in the MailerPress WordPress plugin (versions up to and including 2.0.2) lets an authenticated low-privilege user gain higher privileges through an incorrect privilege assignment flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L) indicates a network-reachable, low-complexity attack that any authenticated user can perform, yielding full confidentiality, integrity, and availability impact - effectively a takeover of the plugin's protected functionality or the WordPress site. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported through Patchstack.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Stored cross-site scripting in the MailerPress WordPress plugin (versions up to 2.0.4) allows authenticated attackers with author-level access or higher to inject arbitrary web scripts via the Campaign HTML Content field. Exploitation is limited to the admin dashboard preview, as the public-facing campaign preview endpoint enforces a Content-Security-Policy blocking inline scripts. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.06%).
MailerPress through version 1.4.2 contains a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to make arbitrary network requests from the affected server. An attacker with valid credentials could exploit this to access internal services, scan the network, or interact with backend systems. No patch is currently available for this vulnerability.
Privilege escalation in the MailerPress WordPress plugin (versions up to and including 2.0.2) lets an authenticated low-privilege user gain higher privileges through an incorrect privilege assignment flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L) indicates a network-reachable, low-complexity attack that any authenticated user can perform, yielding full confidentiality, integrity, and availability impact - effectively a takeover of the plugin's protected functionality or the WordPress site. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported through Patchstack.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Stored cross-site scripting in the MailerPress WordPress plugin (versions up to 2.0.4) allows authenticated attackers with author-level access or higher to inject arbitrary web scripts via the Campaign HTML Content field. Exploitation is limited to the admin dashboard preview, as the public-facing campaign preview endpoint enforces a Content-Security-Policy blocking inline scripts. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.06%).
MailerPress through version 1.4.2 contains a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to make arbitrary network requests from the affected server. An attacker with valid credentials could exploit this to access internal services, scan the network, or interact with backend systems. No patch is currently available for this vulnerability.