Mailersend
Monthly
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.
Cross-site request forgery in the MailerSend WordPress plugin before 1.0.8 enables an unauthenticated remote attacker to wipe the plugin's SMTP configuration and deactivate it entirely by tricking a logged-in administrator into visiting a crafted page. The plugin's configuration-delete action validates the manage_options capability but entirely omits WordPress nonce verification, making administrator sessions exploitable via social engineering. A publicly available exploit demonstrates the attack; successful exploitation silently breaks all outbound email from the affected WordPress site, impacting password resets, order notifications, and transactional messaging.