{
 "id": "WPSEC-2026-1819",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1819/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1819/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1819/index.md",
 "title": "MailerLite – Signup forms (official) <= 1.7.26 - Authenticated (Editor+) Missing Authorization to Embedded Form Modification",
 "description": "The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data via the embedded form edit page in all versions up to, and including, 1.7.26, due to a missing capability check in the AdminController::forms() edit handler for embedded forms. This makes it possible for authenticated attackers whose role the site owner has granted access to the plugin's signup forms (Editor and above by default) to rename embedded forms and change which MailerLite webform they display, even though they hold none of the plugin's per-field edit permissions. This action was intended to be restricted to administrators.",
 "plugin": {
  "slug": "official-mailerlite-sign-up-forms",
  "name": "MailerLite – Signup forms (official)",
  "full_name": "MailerLite – Signup forms (official)",
  "wordpress_org": "https://wordpress.org/plugins/official-mailerlite-sign-up-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/official-mailerlite-sign-up-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/official-mailerlite-sign-up-forms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.27",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.27"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.27",
 "remediation": "Update to 1.7.27 or later.",
 "fix_released": "2026-10-27T08:38:50+00:00",
 "published": "2026-10-28T08:44:34+00:00",
 "updated": "2026-10-27T13:04:36.696923+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1819/",
  "https://plugins.svn.wordpress.org/official-mailerlite-sign-up-forms/tags/1.7.27/",
  "https://wordpress.org/plugins/official-mailerlite-sign-up-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/official-mailerlite-sign-up-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}