CVE-2026-18436: MailPress WordPress Auth Bypass Flaw

CVE-2026-18436 Overview

The MailPress plugin for WordPress contains a missing authorization vulnerability [CWE-862] in versions up to and including 1.5.0. The flaw resides in the campaign revision-restore REST endpoint at POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>. The route registration omitted a permissionCallback, allowing the restoreRevision() handler to execute for unauthenticated requests. Attackers can overwrite a campaign's content_html field with any prior revision without providing credentials.

Critical Impact
Unauthenticated network attackers can modify WordPress email campaign content by restoring arbitrary revisions, enabling content tampering across MailPress campaigns.

Affected Products

MailPress plugin for WordPress, versions up to and including 1.5.0
WordPress sites exposing the MailPress REST API route
Any WordPress installation with the vulnerable CampaignRevisions API handler active

Discovery Timeline

2026-07-31 - CVE-2026-18436 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-18436

Vulnerability Analysis

The vulnerability stems from an incomplete REST route registration inside the MailPress CampaignRevisions API class. When the plugin registers its revision-restore route through register_rest_route(), it does not define a permissionCallback argument. WordPress treats a missing or permissive permissionCallback as an open endpoint, so any HTTP client can invoke the handler.

Once reachable, the restoreRevision() handler locates the specified campaign and revision identifiers, then writes the historical content_html value back onto the live campaign record. No capability check, nonce validation, or ownership check gates this write. Attackers gain the ability to swap campaign content for any archived revision belonging to that campaign, including outdated marketing copy, testing artifacts, or content that predates policy reviews.

The integrity impact is limited to the campaign content_html field, and confidentiality and availability are not directly affected. However, tampered campaigns can be used to distribute misleading or malicious content to subscriber lists, extending downstream impact beyond the WordPress site itself.

Root Cause

The root cause is a missing authorization check on a REST API route. The route in the affected range at CampaignRevisions.php lines 155-156 registers the endpoint without a permissionCallback, violating WordPress REST API security guidance for privileged operations.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id> on a vulnerable site. The server invokes restoreRevision() and updates the campaign HTML with the referenced revision. No user interaction is required, and the attacker only needs to know or enumerate valid campaign and revision identifiers. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-18436

Indicators of Compromise

Unauthenticated POST requests to /wp-json/mailpress/v1/campaign/*/restore-revision/* in web server access logs
Unexpected changes to campaign content_html values without corresponding administrator sessions
MailPress campaigns reverting to older content shortly after external REST API traffic

Detection Strategies

Alert on any request path matching wp-json/mailpress/v1/campaign/*/restore-revision/* where the request is not tied to an authenticated administrative session or valid nonce
Correlate WordPress audit log entries showing campaign updates with the source IP and user agent of REST API callers
Baseline the frequency of MailPress campaign edits and flag anomalies originating outside known admin IP ranges

Monitoring Recommendations

Forward WordPress access logs and application audit events into a centralized SIEM or data lake for correlation
Monitor outbound email campaign content for unauthorized modifications prior to send
Track REST API error rates and 200-response volume on MailPress endpoints to spot enumeration attempts

How to Mitigate CVE-2026-18436

Immediate Actions Required

Update the MailPress plugin to a version later than 1.5.0 as soon as a fixed release is available
Restrict access to /wp-json/mailpress/* at the web application firewall or reverse proxy until patching is complete
Review campaign content and revision history for unauthorized restore operations and revert if needed

Patch Information

At the time of publication, the vulnerability is documented for MailPress versions up to and including 1.5.0. Consult the Wordfence Vulnerability Report and the plugin source repository for updated release information and confirm that the fixed version registers a permissionCallback on the revision-restore route.

Workarounds

Deactivate the MailPress plugin until a patched version is installed
Block unauthenticated access to the restore-revision route with WAF rules or .htaccess restrictions
Require authentication and administrator capability checks at the reverse proxy for all /wp-json/mailpress/v1/campaign/*/restore-revision/* requests

bash

# Example nginx location block to restrict the vulnerable route
location ~ ^/wp-json/mailpress/v1/campaign/[^/]+/restore-revision/[^/]+/?$ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}