The MailerPress WordPress plugin contains a missing capability check on the 'mailerpress/v1/contact' API endpoint, allowing anyone to send contact update requests without authentication. This flaw is categorized as CWE-862 (Missing Authorization). An attacker can modify any contact’s details, potentially altering email lists, personal data, or marketing configurations, compromising the integrity of the data stored by the site.

The vulnerability affects the MailerPress – Newsletter, email marketing & AI automation plugin for WordPress in all releases up to and including version 1.5.0. Users running these versions are at risk; only versions newer than 1.5.0 contain the fix.

With a CVSS score of 5.3 and an EPSS score of less than 1%, the flaw presents a moderate severity and a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers would exploit the flaw by issuing unauthenticated HTTP requests to the vulnerable endpoint, potentially immediately after discovering it in the open source code. Although public exploits are not yet documented, the vulnerability could be leveraged to silently modify user data or inject malicious content into contact records.