CVE-2026-13156: 
WordPress vulnerability analysis and mitigation

CVE-2026-13156 is a Cross-Site Request Forgery (CSRF) vulnerability in the MailerSend – Official SMTP Integration WordPress plugin affecting all versions before 1.0.8. The flaw allows an unauthenticated attacker to trick a logged-in administrator into visiting a crafted page, which deletes the plugin's SMTP configuration and deactivates the plugin, breaking the site's email delivery. It was publicly disclosed on June 29, 2026, and assigned a CVSS score of 5.4 (Medium) (WPScan, GitHub Advisory).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The plugin's configuration-delete action correctly verifies that the requesting user holds the manage_options capability but fails to validate the WordPress nonce, meaning any authenticated administrator's browser can be coerced into submitting the destructive request. An attacker crafts a malicious HTML page containing a hidden auto-submitting form targeting the plugin's delete action endpoint; when an administrator visits the page while logged in, the browser automatically sends the forged request with valid session credentials. The original researcher and submitter is Huynh Kien Minh (WPScan).

Successful exploitation results in the complete deletion of the MailerSend plugin's SMTP configuration from the WordPress database and automatic deactivation of the plugin, disabling the site's email delivery capability. This is an availability and integrity impact — no confidentiality breach or code execution is involved. The attack requires no privileges on the attacker's part but does require social engineering a logged-in administrator, limiting its scope to sites where an admin can be lured to a malicious page (WPScan, GitHub Advisory).

1. Reconnaissance: Identify target WordPress sites using the MailerSend – Official SMTP Integration plugin (versions < 1.0.8) via passive enumeration (e.g., checking plugin directories or HTTP response headers).
2. Craft malicious page: Create an HTML file containing a hidden form that auto-submits a POST request to the target site's WordPress admin endpoint for the MailerSend configuration-delete action (e.g., http://target-site.com/wp-admin/admin-post.php or equivalent), including the required action parameter but omitting or providing an invalid nonce.
3. Host the page: Host the crafted HTML file on an attacker-controlled server or deliver it via email, forum post, or other social engineering channel.
4. Lure the administrator: Trick a logged-in WordPress administrator into visiting the malicious URL (e.g., via phishing email or malicious link).
5. Trigger the action: The administrator's browser automatically submits the forged form. Because the plugin only checks manage_options capability (satisfied by the admin's session) and ignores the nonce, the request is accepted.
6. Result: The MailerSend SMTP configuration is wiped from the database and the plugin is deactivated, disabling the site's email delivery (WPScan).

• Logs: WordPress admin action logs showing a configuration-delete request for the MailerSend plugin originating from an unexpected referrer or external domain; absence of a valid nonce in the request parameters.
• Application State: MailerSend plugin appearing as deactivated in the WordPress plugin list without administrator intent; MailerSend SMTP settings absent from the WordPress options table (wp_options).
• Network: HTTP POST requests to the WordPress admin endpoint for the MailerSend delete action originating from an unusual or external referrer URL in web server access logs.

Update the MailerSend – Official SMTP Integration WordPress plugin to version 1.0.8 or later, which includes a proper nonce check on the configuration-delete action. No configuration-based workaround is available for unpatched versions. As a general defense-in-depth measure, administrators should avoid clicking on untrusted links while logged into the WordPress admin panel, and consider deploying a web application firewall or security plugin that enforces CSRF protections (WPScan, GitHub Advisory).