WordPress Plugin Vulnerabilities

MailPoet < 5.33.1 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in a function, which could allow attackers to make logged in admins perform unwanted actions via a CSRF attack.

Affects Plugins

Plugin icon
mailpoet
Fixed in 5.33.1

References

CVE
CVE-2026-57626
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e1371a5-ed2e-4a1b-901e-8aef4d0d3acf

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
f2d831b7-aa4f-47e3-833a-9da516d82ff9

Timeline

Publicly Published
2026-07-21 (about 2 months ago)
Added
2026-07-27 (about 2 months ago)
Last Updated
2026-07-27 (about 2 months ago)

Other

Published
Title
Published
2024-11-22
Title
ITERAS < 1.8.1 - Stored XSSS via CSRF
Published
2024-01-19
Title
lasTunes <= 3.6.1 - Settings Update via CSRF
Published
2025-03-18
Title
FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions
Published
2024-07-09
Title
WP Ajax Contact Form <= 2.2.2 - Arbitrary Email Deletion via CSRF
Published
2025-06-05
Title
Interactive Regional Map of Africa <= 1.0 - Cross-Site Request Forgery