CVE-2026-13156 — MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

CVE-2026-13156

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF PUBLISHED

Description (CNA)

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.

Affected (CNA)

Vendor / product	Versions
Unknown / MailerSend	affected 0 before 1.0.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/595e653d-0904-43cf-8e61-d684599de11b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.