PT-2026-20382 · WordPress · Brevo – Email

Ismailshadow · Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-14799

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress versions up to and including 3.3.0

Description The Brevo plugin for WordPress has an authorization bypass issue caused by type juggling. This occurs because of the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID. An unauthenticated attacker can exploit this by sending a boolean true value for the id parameter to the /wp-json/mailin/v1/mailin disconnect API endpoint. Successful exploitation allows attackers to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings. The vulnerable parameter is id.

Recommendations Update the Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress to a version later than 3.3.0.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-14799

Affected Products

Brevo – Email

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14799 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f29e5b19-2505-4b02-92c7-071833de6bc2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/mailin/tags/3.2.9/sendinblue.php#L1795 · Note
• https://twitter.com/CVEnew/status/2024090423820476656 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024105299502624823 · Twitter Post
• https://t.me/CVEtracker/44968 · Telegram Post
• https://plugins.trac.wordpress.org/browser/mailin/tags/3.2.9/sendinblue.php#L1833 · Note
• https://plugins.trac.wordpress.org/changeset/3448639 · Note
• https://t.me/cveNotify/152307 · Telegram Post