MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 2.1.3 - Unauthenticated Sensitive Information Exposure via Subscriber Page Preview Mode

ID

WPSEC-2026-1709

Plugin

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails (mailerpress)

Affected

all versions before 2.2

Remediation

Update to 2.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27

Attack surface

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails on WPSec AttackSurface

Fix released

2026-10-26

Published

2026-10-27

Description

The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Sensitive Information Exposure via the preview mode of the [mailerpress_pages] subscriber pages in all versions up to, and including, 2.1.3, due to the preview mode being enabled by a URL parameter such as 'mp_preview' with no authentication or capability check. This makes it possible for unauthenticated attackers to view the site administrator's email address and first and last name on the 'Manage subscription' page.

References

• https://wpsec.com/vuln/WPSEC-2026-1709/
• https://plugins.svn.wordpress.org/mailerpress/tags/2.2/
• https://wordpress.org/plugins/mailerpress/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS