{"id":19018928,"date":"2026-09-13T15:31:04","date_gmt":"2026-09-13T15:31:04","guid":{"rendered":"https:\/\/wordpress.org\/support\/?post_type=topic&#038;p=19018928"},"modified":"2026-09-13T16:53:59","modified_gmt":"2026-09-13T16:53:59","slug":"vulnerability-180","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/vulnerability-180\/","title":{"rendered":"Vulnerability"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi team,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Patchstack published CVE-2026-81783 on Sept 10, a Subscriber Broken Authentication issue affecting MailMunch \u2013 Grow your Email List in all versions up to and including 3.2.5. Advisory here:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailmunch\/vulnerability\/wordpress-mailmunch-grow-your-email-list-plugin-3-2-5-broken-authentication-vulnerability\">https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailmunch\/vulnerability\/wordpress-mailmunch-grow-your-email-list-plugin-3-2-5-broken-authentication-vulnerability<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s rated CVSS 7.1 (High), CWE-288, vector CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:H. As of today, 3.2.5 is still the current release on the WordPress.org directory, so there&#8217;s no update available to resolve it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I manage a number of sites running this plugin and I&#8217;d like to know:<\/p>\n\n\n\n<ol>\n<li>Is a fixed release in progress, and is there a rough timeline?<\/li>\n\n\n\n<li>In the meantime, is there a recommended interim mitigation from your side (a setting to change, or a specific configuration that reduces exposure)?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For context, I noticed 3.2.2 addressed an earlier CVE (CVE-2026-7520) fairly quickly with capability and nonce checks, so I&#8217;m hopeful this one is on the radar too. Any update would help me decide whether to hold for the patch or temporarily deactivate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thanks!<\/p>\n","protected":false},"template":"","class_list":["post-19018928","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19018928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19018928\/revisions"}],"predecessor-version":[{"id":19018959,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19018928\/revisions\/19018959"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19018928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}