Vulnerabilities / Mortgage Calculators WP / WPSEC-2026-1861
Mortgage Calculators WP < 1.64 - Unauthenticated Email Content Injection via Send Results
Medium 5.3
CWE-74Fixed in 1.64
- ID
- WPSEC-2026-1861
- Plugin
- Mortgage Calculators WP (mortgage-calculators-wp)
- Affected
- all versions before 1.64
- Remediation
- Update to 1.64 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- Mortgage Calculators WP on WPSec AttackSurface
- Fix released
- Published
Description
The Mortgage Calculators WP plugin for WordPress is vulnerable to Email Content Injection via the calculator's 'Send Results' email in versions before 1.64. The sending action is open to unauthenticated visitors by design, but it accepted any recipient address, placed the posted calculation values, which could hold any text, into the HTML results email, and had no rate limit. This makes it possible for unauthenticated attackers to make the site send emails from its own address to arbitrary recipients containing attacker-chosen text, for example for phishing or spam.
References
- https://wpsec.com/vuln/WPSEC-2026-1861/
- https://plugins.svn.wordpress.org/mortgage-calculators-wp/tags/1.64/
- https://wordpress.org/plugins/mortgage-calculators-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS