{"id":"CVE-2026-3253","aliases":["EUVD-2026-85854","GHSA-h68w-8j2h-7hvq"],"status":"published","title":"MailerLite – Signup forms (official) \u003c= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion","description":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00188,"percentile":0.08451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-24T11:31:08Z","modified":"2026-09-24T15:17:21Z","products":[{"vendor":"mailerlite","product":"mailerlite – signup forms (official)"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3505999/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3253"},{"url":"https://plugins.trac.wordpress.org/changeset/3505999"},{"url":"https://github.com/advisories/GHSA-h68w-8j2h-7hvq"}],"sources":{"cve":[{"id":"CVE-2026-3253","title":"MailerLite – Signup forms (official) \u003c= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion","description":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","status":"published","published":"2026-09-24T11:31:08.94Z","modified":"2026-09-24T14:34:00.566Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-85854","description":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","status":"published","published":"2026-09-24T11:31:08Z","modified":"2026-09-24T14:34:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:57.035497Z"}],"ghsa":[{"id":"GHSA-h68w-8j2h-7hvq","title":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized...","description":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","status":"published","published":"2026-09-24T12:31:23Z","modified":"2026-09-24T12:31:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:22.2852Z"}],"nvd":[{"id":"CVE-2026-3253","description":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","status":"published","published":"2026-09-24T12:17:12.16Z","modified":"2026-09-24T15:17:21.977Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}