Vulnerabilities / WP Mailster / WPSEC-2026-0421
WP Mailster <= 1.9.0.0 - Authenticated (Contributor+) Missing Authorization to Mail Server Settings Exposure and Modification
High 7.6
CWE-862Fixed in 1.9.1.0
- ID
- WPSEC-2026-0421
- Plugin
- WP Mailster (wp-mailster)
- Affected
- all versions before 1.9.1.0
- Remediation
- Update to 1.9.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Mailster on WPSec AttackSurface
- Fix released
- Published
Description
The WP Mailster plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.9.0.0 due to the 'Servers' and 'Add Server' admin pages being registered with the 'edit_posts' capability and lacking a capability check in their page, screen-option and bulk-action handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the plugin's configured mail servers, including OAuth client secrets, and to add, modify, deactivate or delete the mail server configurations used by mailing lists.
References
- https://wpsec.com/vuln/WPSEC-2026-0421/
- https://plugins.svn.wordpress.org/wp-mailster/tags/1.9.1.0/
- https://wordpress.org/plugins/wp-mailster/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS