medium5.4
CVE-2026-13156
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but i…
Impact
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Affected products
| Product | Affected versions |
|---|---|
| MailerSend WordPress Plugin | before 1.0.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.