CVE-2026-18437
Received Received - Intake

Unauthenticated Contact Update in MailerPress WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Wordfence

Description
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerpress/v1/contact` endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update contact details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-18437
EUVD
EUVD-2026-51506

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailerpress mailerpress to 1.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MailerPress plugin for WordPress has a vulnerability due to a missing capability check on the mailerpress/v1/contact endpoint. This allows unauthenticated attackers to update contact details without authorization.

Detection Guidance

Check WordPress sites using MailerPress plugin versions up to 1.5.0 for unauthorized contact updates via the mailerpress/v1/contact endpoint. Monitor logs for suspicious POST requests to this path.

Impact Analysis

Unauthenticated attackers could modify contact details, potentially leading to data corruption or unauthorized changes in email marketing campaigns. This could disrupt services or expose sensitive information.

Compliance Impact

This vulnerability may lead to unauthorized data modifications, which could violate integrity requirements in GDPR or HIPAA. Unauthorized access risks non-compliance with data protection regulations.

Mitigation Strategies

Update MailerPress plugin to the latest version beyond 1.5.0. If immediate update is not possible, disable the plugin or restrict access to the mailerpress/v1/contact endpoint via server rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart