CVE-2026-39791
WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
- Record
CVE-2026-39791- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2026-93035
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
- Record
EUVD-2026-93035- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g35c-mm2g-fxmw
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
- Record
GHSA-g35c-mm2g-fxmw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
NVD
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
- Record
CVE-2026-39791- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-39791 is a medium vulnerability (CVSS 5.3) in Mailjet Email Marketing, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.