The MailerSend WordPress plugin before version 1.0.8 omits a nonce check in its configuration‑delete action, performing only a capability verification. This omission allows an attacker to lure a logged‑in administrator to a malicious URL that triggers the delete operation, wiping the SMTP configuration and deactivating the plugin. The weakness exemplifies the classic CSRF flaw described by CWE‑352, relying on an authenticated user’s session to execute unintended administrative changes.

WordPress sites running the MailerSend plugin older than version 1.0.8 are affected. Any installation that has not applied the 1.0.8 release is vulnerable to this CSRF attack when an administrator is presented with a forged link.

The CVSS score of 5.4 classifies the issue as moderate severity. An EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires social engineering: an attacker must get an authenticated administrator to click a crafted URL. Given the moderate score, the low EPSS, and the necessity of user interaction, the overall risk is moderate but remedial action is advised promptly.