Back to overview

CVE-2026-13156

MEDIUM Exploitation: PoC
5.4
CVSS 3.1
Description
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.

Metadata

CVE ID
CVE-2026-13156
State
PUBLISHED
Assigner
WPScan
Reserved
2026-06-24 12:02 UTC
Published
2026-07-20 06:00 UTC
Last updated
2026-07-20 13:12 UTC
Primary CWE
CWE-352
CWE-352 Cross-Site Request Forgery (CSRF)
Vendor / Product
Unknown / MailerSend
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Unknown MailerSend — 0 < 1.0.8
Weakness (CWE)
CWESourceDescription
— cna CWE-352 Cross-Site Request Forgery (CSRF)
CWE-352 adp CWE-352 Cross-Site Request Forgery (CSRF)
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
References (1)
Back to overview