Vulnerability · Published Apr 8, 2026 · Assigned by Patchstack

CVE-2026-39713WordPress Mailercloud – Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control vulnerability

Medium 5.3

In plain English

A medium-severity missing authorization in Mailercloud – Integrate webforms and synchronize website contacts from mailercloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.

Affected products (as reported)

Vendor	Product	Versions
mailercloud	Mailercloud – Integrate webforms and synchronize website contacts	0 – through 1.0.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://patchstack.com/database/Wordpress/Plugin/mailercloud-integrate-webforms-synchronize-contacts/vulnerability/wordpress-mailercloud-integrate-webforms-and-synchronize-website-contacts-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve vdb-entry