CVE-2026-13156

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

0.14% chance of exploitation in the next 30 days, 3th percentile

Published

2026-07-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/595e653d-0904-43cf-8e61-d684599de11b/

References

• CVE Record
• NVD entry

Related

• CVE-2026-13154
• CVE-2026-13157
• CVE-2026-13153
• CVE-2026-13158
• CVE-2026-13152
• CVE-2026-13168