{
 "id": "WPSEC-2026-1861",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1861/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1861/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1861/index.md",
 "title": "Mortgage Calculators WP < 1.64 - Unauthenticated Email Content Injection via Send Results",
 "description": "The Mortgage Calculators WP plugin for WordPress is vulnerable to Email Content Injection via the calculator's 'Send Results' email in versions before 1.64. The sending action is open to unauthenticated visitors by design, but it accepted any recipient address, placed the posted calculation values, which could hold any text, into the HTML results email, and had no rate limit. This makes it possible for unauthenticated attackers to make the site send emails from its own address to arbitrary recipients containing attacker-chosen text, for example for phishing or spam.",
 "plugin": {
  "slug": "mortgage-calculators-wp",
  "name": "Mortgage Calculators WP",
  "full_name": "Mortgage Calculators WP",
  "wordpress_org": "https://wordpress.org/plugins/mortgage-calculators-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mortgage-calculators-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.64",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.64"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.64",
 "remediation": "Update to 1.64 or later.",
 "fix_released": "2026-10-27T17:35:19+00:00",
 "published": "2026-10-28T17:42:28+00:00",
 "updated": "2026-10-28T09:34:21.896265+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1861/",
  "https://plugins.svn.wordpress.org/mortgage-calculators-wp/tags/1.64/",
  "https://wordpress.org/plugins/mortgage-calculators-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}