CVE-2026-105055: WP Mailster Auth Bypass Vulnerability

CVE-2026-105055 Overview

CVE-2026-105055 is a missing authorization vulnerability [CWE-862] affecting the WP Mailster plugin for WordPress. The flaw stems from incorrectly configured access control security levels in versions up to and including 1.9.0.0. Unauthenticated attackers can reach functionality that should require authorization checks. The issue is reachable over the network without user interaction or privileges. According to the CVSS vector, the impact is limited to confidentiality, with no direct effect on integrity or availability.

Critical Impact

Unauthenticated remote attackers can exploit broken access control in WP Mailster to access protected plugin functionality and disclose limited information from affected WordPress sites.

Affected Products

• WP Mailster plugin for WordPress
• Versions from n/a through 1.9.0.0
• WordPress sites running the vulnerable wp-mailster plugin

Discovery Timeline

• 2026-10-05 - CVE-2026-105055 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105055

Vulnerability Analysis

The vulnerability is a Missing Authorization issue classified under [CWE-862]. WP Mailster exposes plugin endpoints that fail to enforce proper capability or role checks before executing privileged logic. An attacker sending crafted HTTP requests to the plugin's handlers reaches functionality that should be restricted to authenticated or privileged users.

Because the plugin is reachable over the network and the attack complexity is low, exploitation does not require special conditions, credentials, or user interaction. The impact is scoped to confidentiality, meaning an attacker can read data or trigger actions that disclose information the plugin should keep protected.

The EPSS probability currently sits at 0.187%, indicating low observed exploitation likelihood, but the absence of authentication requirements lowers the barrier for opportunistic scanning.

Root Cause

The root cause is incorrectly configured access control security levels inside the wp-mailster plugin. Request handlers in affected versions do not validate the caller's capabilities before performing sensitive operations. This matches the Broken Access Control class of flaws documented in Patchstack's advisory.

Attack Vector

An unauthenticated attacker sends HTTP requests to vulnerable WP Mailster endpoints on a WordPress site. The plugin processes the request without verifying authorization and returns or acts on data that should be gated behind permission checks. No social engineering or user interaction is required.

See the Patchstack WP Mailster Vulnerability advisory for additional technical context. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2026-105055

Indicators of Compromise

• Unauthenticated HTTP requests to WP Mailster plugin endpoints under /wp-admin/admin-ajax.php or /wp-content/plugins/wp-mailster/ paths.
• Unexpected responses containing WP Mailster configuration, subscriber data, or newsletter content from unauthenticated sessions.
• Spikes in anonymous traffic patterns targeting wp-mailster action parameters.

Detection Strategies

• Review WordPress and web server access logs for requests to wp-mailster endpoints originating from unauthenticated sessions.
• Correlate HTTP 200 responses to plugin-specific actions with the absence of valid WordPress authentication cookies or nonces.
• Deploy WAF rules that flag unauthenticated access attempts to WP Mailster administrative actions.

Monitoring Recommendations

• Monitor the installed version of WP Mailster across managed WordPress deployments and alert on versions at or below 1.9.0.0.
• Track outbound data volumes and newsletter list access events to detect enumeration of subscriber information.
• Enable WordPress audit logging for plugin activity and ingest it into a centralized SIEM for correlation.

How to Mitigate CVE-2026-105055

Immediate Actions Required

• Identify all WordPress sites running WP Mailster and inventory the installed plugin version.
• Upgrade WP Mailster to a version released after 1.9.0.0 that addresses the broken access control issue, as referenced in the Patchstack advisory.
• If no fixed version is available in your environment, deactivate and remove the wp-mailster plugin until a patch is applied.

Patch Information

Refer to the Patchstack WP Mailster Vulnerability advisory for current patch status and vendor remediation guidance. The advisory lists affected versions as n/a through 1.9.0.0.

Workarounds

• Restrict access to WordPress admin and AJAX endpoints via IP allowlisting at the web server or WAF layer where feasible.
• Apply virtual patching rules in a web application firewall to block unauthenticated requests to WP Mailster action handlers.
• Disable the plugin on sites that do not actively use its newsletter functionality.

# Configuration example: block unauthenticated access to WP Mailster plugin paths in Nginx
location ~* /wp-content/plugins/wp-mailster/ {
    deny all;
    return 403;
}