CVE-2026-3253
Received Received - Intake

Unauthorized Form Modification in MailerLite WordPress Plugin

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: Wordfence

Description
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-3253
EUVD
EUVD-2026-85854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailerlite signup_forms to 1.7.21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MailerLite Signup Forms plugin for WordPress has a vulnerability due to a missing capability check in the forms() method of the AdminController class. This allows authenticated attackers with Contributor-level access or higher to create or delete arbitrary signup forms without proper authorization.

Detection Guidance

Check WordPress plugins for MailerLite – Signup forms version 1.7.21 or lower. Review admin logs for unauthorized form creation or deletion by Contributor-level users or above.

Impact Analysis

This vulnerability allows attackers to modify signup forms, potentially disrupting email marketing campaigns or collecting user data without consent. It requires at least Contributor-level access, so only users with some administrative privileges can exploit it.

Compliance Impact

This vulnerability could lead to unauthorized data collection or form modifications, potentially violating GDPR by processing data without consent or HIPAA by altering forms handling protected health information. Compliance risks depend on how the forms are used and the data collected.

Mitigation Strategies

Update the MailerLite – Signup forms plugin to the latest version. Restrict Contributor-level and higher user roles to only necessary permissions. Monitor for suspicious form modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart