CVE-2026-18436

The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). The route in the vulnerable range was registered without a permissionCallback, allowing the restoreRevision() handler to run for unauthenticated requests and overwrite a campaign's content_html with any prior revision. This makes it possible for unauthenticated attackers to modify campaign content by restoring an arbitrary revision.

• CWE-862

• https://plugins.trac.wordpress.org/browser/mailerpress/trunk/src/Api/CampaignRevisions.php#L155
• https://plugins.trac.wordpress.org/browser/mailerpress/trunk/src/Api/CampaignRevisions.php#L156
• https://www.wordfence.com/threat-intel/vulnerabilities/id/793a7ef0-8938-47a6-80ed-83f69fbbb27f?source=cve

Published

Jul 31, 2026

Last Modified

Jul 31, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18411The KARR Security System and SWDS dealer-installed automotiv…8.1
• CVE-2026-18412OpenCart extensions are uploaded as zip files with .ocmod.zi…
• CVE-2026-1842HyperCloud versions 2.3.5 through 2.6.8 improperly allowed r…6.2
• CVE-2026-18427@fastify/static before version 10.1.3 contains an incomplete…7.5
• CVE-2026-1843The Super Page Cache plugin for WordPress is vulnerable to S…7.2
• CVE-2026-18435The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…6.4
• CVE-2026-18437The MailerPress – Newsletter, email marketing & AI automatio…5.3
• CVE-2026-1844The PixelYourSite PRO plugin for WordPress is vulnerable to …7.2
• CVE-2026-18446fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal d…7.5
• CVE-2026-1845The Real Estate Pro plugin for WordPress is vulnerable to St…5.5
• CVE-2026-18452DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard…10
• CVE-2026-1846Rejected reason: loading template...