CVE-2026-13156
Deferred Deferred - Pending Action

MailerSend WordPress Plugin SMTP Configuration Deletion

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WPScan

Description
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-13156
EUVD
EUVD-2026-45890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailersend official_smtp_integration to 1.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the MailerSend WordPress plugin versions before 1.0.8. The plugin fails to verify a security token (nonce) when performing a configuration-delete action, even though it checks for administrator privileges. An attacker can exploit this by tricking an admin into visiting a malicious page that sends a crafted request to delete the plugin's SMTP settings and deactivate it, breaking email delivery on the site.

Detection Guidance

Check if the MailerSend WordPress plugin version is below 1.0.8. Log in as an administrator and inspect the plugin's version in the WordPress admin panel. Alternatively, use WP-CLI with the command: wp plugin list --name=mailersend to verify the installed version.

Impact Analysis

If exploited, this vulnerability can disrupt your WordPress site's email functionality by removing the MailerSend plugin's SMTP configuration and deactivating the plugin. This would prevent your site from sending emails, including password resets, notifications, or contact form submissions, potentially breaking core site operations.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by disrupting email delivery functionality, which may be used for notifications, alerts, or data processing. If email delivery is compromised, organizations might fail to meet notification or communication requirements under these regulations.

Mitigation Strategies

Update the MailerSend WordPress plugin to version 1.0.8 or later immediately. If updating is not possible, consider temporarily disabling the plugin until an update can be applied to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart