# Mortgage Calculators WP < 1.64 - Unauthenticated Email Content Injection via Send Results

- **ID:** WPSEC-2026-1861
- **Plugin:** Mortgage Calculators WP (`mortgage-calculators-wp`), https://wordpress.org/plugins/mortgage-calculators-wp/
- **Affected versions:** all versions before 1.64
- **Fixed in:** 1.64 (Update to 1.64 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1861/

## Description

The Mortgage Calculators WP plugin for WordPress is vulnerable to Email Content Injection via the calculator's 'Send Results' email in versions before 1.64. The sending action is open to unauthenticated visitors by design, but it accepted any recipient address, placed the posted calculation values, which could hold any text, into the HTML results email, and had no rate limit. This makes it possible for unauthenticated attackers to make the site send emails from its own address to arbitrary recipients containing attacker-chosen text, for example for phishing or spam.

## References

- https://wpsec.com/vuln/WPSEC-2026-1861/
- https://plugins.svn.wordpress.org/mortgage-calculators-wp/tags/1.64/
- https://wordpress.org/plugins/mortgage-calculators-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1861/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.