Security Alert Summary
The MailerSend WordPress plugin prior to 1.0.8 fails to perform a nonce check on its configuration-delete action. Although the plugin verifies the manage_options capability, it ignores the nonce, allowing an attacker to trick a logged-in administrator into visiting a crafted page that wipes SMTP configuration and deactivates the plugin, which can break the site\’s email delivery.
CVE Details
- CVE ID: CVE-2026-13156
- Affected component: MailerSend WordPress plugin
- Affected versions: Versions earlier than 1.0.8
- Published: July 20, 2026 at 07:16:35 AM UTC
- Last modified: July 20, 2026 at 02:16:53 PM UTC
- CVSS v3.1: Base Score 5.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Authentication / Privileges / User interaction: Privileges Required: NONE (per CVSS). User Interaction: REQUIRED. The plugin verifies the manage_options capability but does not validate a nonce on the configuration-delete action, enabling exploitation when an administrator visits a crafted page.
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: LOW
- Weakness (CWE): CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability is a missing nonce (CSRF) check on the plugin\’s configuration-delete action. The MailerSend plugin performs a capability check (manage_options) but ignores the nonce token that would prevent cross-site request forgery. As a result, an attacker can craft a link or webpage that, if visited by a logged-in administrator, triggers the configuration-delete action.
On successful exploitation the plugin\’s SMTP configuration can be wiped and the MailerSend plugin can be deactivated. The description does not name specific functions or REST endpoints; only the configuration-delete action and the lack of a nonce check are documented.
The impact is limited to modification and availability of the plugin\’s configuration and operation (integrity and availability). There is no CVSS indication of confidentiality loss from this issue itself.
How This Could Impact Your Website
Imagine a typical small business WordPress site with a site owner, an internal content editor, and an external developer or contractor who occasionally performs maintenance. An attacker could send or host a crafted page and convince an administrator to open it while logged into the site. If the admin visits the page, the site\’s MailerSend SMTP settings might be erased and the plugin deactivated.
Practical consequences include:
- Outgoing email failures for notifications, password resets, and transactional messages.
- Delays in account recovery or administrative workflows due to missing email delivery.
- Increased risk of targeted phishing or social engineering, as disrupted email channels and communication confusion can be exploited.
- Potential indirect exposure of internal user contact details during remediation steps or when administrators export user lists to diagnose email issues.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is made available.
- Review and reduce unnecessary user roles, especially limiting Administrator accounts and Contributor/editor privileges where possible.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected plugin deactivation or configuration changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
