MailerLite – Signup forms (official) <= 1.7.26 - Authenticated (Editor+) Missing Authorization to Embedded Form Modification
- ID
- WPSEC-2026-1819
- Plugin
- MailerLite – Signup forms (official) (official-mailerlite-sign-up-forms)
- Affected
- all versions before 1.7.27
- Remediation
- Update to 1.7.27 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- MailerLite – Signup forms (official) on WPSec AttackSurface
- Fix released
- Published
Description
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data via the embedded form edit page in all versions up to, and including, 1.7.26, due to a missing capability check in the AdminController::forms() edit handler for embedded forms. This makes it possible for authenticated attackers whose role the site owner has granted access to the plugin's signup forms (Editor and above by default) to rename embedded forms and change which MailerLite webform they display, even though they hold none of the plugin's per-field edit permissions. This action was intended to be restricted to administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-1819/
- https://plugins.svn.wordpress.org/official-mailerlite-sign-up-forms/tags/1.7.27/
- https://wordpress.org/plugins/official-mailerlite-sign-up-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS