CVE-2026-18437: MailerPress Auth Bypass Vulnerability

CVE-2026-18437 Overview

CVE-2026-18437 is a missing authorization vulnerability in the MailerPress newsletter, email marketing, and AI automation plugin for WordPress. The flaw affects all versions up to and including 1.5.0. The mailerpress/v1/contact REST endpoint lacks a capability check, allowing unauthenticated attackers to update contact records over the network. The weakness is classified under [CWE-862: Missing Authorization]. Wordfence published the advisory as vulnerability entry 159d031b-0362-4625-9d98-3908401c8ee8.

Critical Impact
Unauthenticated network attackers can modify subscriber contact details managed by MailerPress, compromising the integrity of newsletter and marketing data on affected WordPress sites.

Affected Products

MailerPress – Newsletter, email marketing & AI automation plugin for WordPress
All plugin versions through 1.5.0
WordPress sites exposing the mailerpress/v1/contact REST route

Discovery Timeline

2026-07-31 - CVE-2026-18437 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-18437

Vulnerability Analysis

The vulnerability resides in the MailerPress REST API surface, specifically the mailerpress/v1/contact endpoint implemented in src/Api/Contacts.php. The handler processes contact update operations without validating the caller's WordPress capability or authentication state. Because WordPress REST routes are reachable over the network with no user interaction, any remote client can invoke the update handler. The impact is scoped to integrity of contact records, not confidentiality or availability of the underlying WordPress installation. EPSS data lists the exploitation probability at 0.297%.

Root Cause

The underlying issue is a missing permission_callback (or equivalent capability check) on the REST route registration. WordPress requires developers to explicitly gate REST endpoints with current_user_can() or a comparable check. The relevant handlers around lines 801 and 847 of Contacts.php proceed to mutate contact data without confirming the request originates from an authorized user role such as manage_options or a plugin-specific capability.

Attack Vector

An attacker crafts an HTTP request to the vulnerable REST route on a target WordPress site and supplies contact identifiers and updated field values in the request body. No credentials, tokens, or nonces are required. Successful requests overwrite subscriber attributes such as email addresses, names, or list membership. Attackers can automate the abuse against any site fingerprinted as running MailerPress <= 1.5.0.

No public proof-of-concept code has been released. See the Wordfence Vulnerability Report and the vulnerable code paths in Contacts.php line 801 and Contacts.php line 847 for technical detail.

Detection Methods for CVE-2026-18437

Indicators of Compromise

Unauthenticated HTTP POST or PUT requests to /wp-json/mailerpress/v1/contact from unexpected source IPs.
Unexplained modifications to subscriber records, including altered email addresses, names, or list assignments.
Bursts of REST API traffic to MailerPress routes without a preceding authenticated session cookie.

Detection Strategies

Enable WordPress REST API access logging and alert on requests to mailerpress/v1/* routes lacking an authenticated user context.
Compare current contact records against periodic database snapshots to identify unauthorized field-level changes.
Deploy a web application firewall (WAF) rule that blocks or challenges unauthenticated writes to the vulnerable endpoint.

Monitoring Recommendations

Aggregate web server and PHP-FPM logs into a centralized analytics platform and pivot on request paths containing mailerpress/v1/contact.
Track HTTP verb distribution on plugin endpoints; write verbs from anonymous callers warrant investigation.
Alert on plugin version inventory reporting MailerPress <= 1.5.0 across managed WordPress fleets.

How to Mitigate CVE-2026-18437

Immediate Actions Required

Inventory all WordPress sites running the MailerPress plugin and identify versions <= 1.5.0.
Update MailerPress to a patched release published after version 1.5.0 as soon as the vendor makes it available.
Restrict access to /wp-json/mailerpress/v1/contact at the WAF or reverse proxy until the patch is applied.
Audit MailerPress contact data for unauthorized modifications and restore from backup where tampering is confirmed.

Patch Information

At the time of publication, review the Wordfence Vulnerability Report for the current fixed version. Apply the vendor update through the WordPress plugin management screen or via wp-cli using wp plugin update mailerpress.

Workarounds

Deactivate the MailerPress plugin until a patched version is installed.
Add a WAF rule that denies unauthenticated requests to /wp-json/mailerpress/v1/contact.
Use an mu-plugin filter on rest_pre_dispatch to reject requests to the vulnerable route when is_user_logged_in() returns false.

bash

# Configuration example: block the vulnerable route at the web tier (nginx)
location ~* /wp-json/mailerpress/v1/contact {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}