[ CVE-2026-3253 · Published 24 Sep 2026 ]
Vulnerability in MailerLite – Signup forms (official)
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.