Description

WordPress Plugin MailPress is prone to multiple vulnerabilities, including local file inclusion and security bypass vulnerabilities. Exploiting these issues could allow an attacker to obtain sensitive information that could aid in further attacks or to perform otherwise restricted actions and subsequently add or remove capabilities to WordPress roles. WordPress Plugin MailPress version 5.4.4 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2016/07/14/local-file-inclusion-lfi-vulnerability-in-mailpress/

https://www.pluginvulnerabilities.com/2016/07/14/capabilities-change-vulnerability-in-mailpress/

http://blog.mailpress.org/2016/07/23/mailpress-temporarily-withdrawn-from-the-wordpress-plugin-repository/

Related Vulnerabilities

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7937)

Python Improper Input Validation Vulnerability (CVE-2018-20852)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-4576)

TCExam Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5750)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2025-30762)

Severity

High

Classification

CWE-22 CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update