CVE-2026-13156— MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
Possible ATT&CK Techniques 1AI
T1134 · Access Token ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | MailerSend | < 1.0.8 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
Source: NVD (National Vulnerability Database)
Vulnerability Description
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | MailerSend | 0 ~ 1.0.8 | - |
II. Public POCs for CVE-2026-13156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13156
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-13156 (1)
Same Patch Batch · Unknown · 2026-07-20 · 18 CVEs total
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | |
| CVE-2026-10081 | Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews | |
| CVE-2026-10724 | Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Rev | |
| CVE-2026-10755 | All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration | |
| CVE-2026-11349 | Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_ | |
| CVE-2026-12723 | Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via | |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | |
| CVE-2026-11868 | WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File W | |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | |
| CVE-2026-12973 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Mo | |
| CVE-2026-12972 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering | |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-p | |
| CVE-2026-8825 | Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API | |
| CVE-2026-13147 | Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis | |
| CVE-2026-13142 | Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email O | |
| CVE-2026-13432 | ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-9833
Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Par - CVE-2026-13432
ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation - CVE-2026-13142
Passwordless Login by VentraConnect < 1.4.1 - Unauthenticate - CVE-2026-13147
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery - CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Discl
V. Comments for CVE-2026-13156
No comments yet