MailerLite Signup Forms CVE-2026-3253

Requires an authenticated WordPress account with Contributor-level capability or higher on a site running the MailerLite - Signup forms (official) plugin version 1.7.21 or earlier; the flaw is reachable because the forms() method of AdminController performs no capability check. Limiting factors: the attacker must already have (or register for) a Contributor account, so sites that do not grant Contributor access to untrusted users are far less exposed; impact is confined to creating or deleting signup forms (integrity only) with no data disclosure or site-wide denial of service. No user interaction is needed once the account is held.

This is a genuine but low-severity issue that should be triaged as routine patching rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3 MEDIUM) is internally consistent with the CWE-862 missing-authorization description: network-reachable, low complexity, no user interaction, but requiring authenticated Contributor-level access and yielding only limited integrity impact (create/delete signup forms) with no confidentiality or availability effect. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The main risk driver is that many WordPress sites grant Contributor accounts liberally (guest authors, multi-author blogs), lowering the practical bar for the PR:L requirement. Net: real but low priority; the low, single-vector integrity impact and authentication requirement keep this well below a high-urgency flaw despite the network attack vector. A patch is confirmed available, so the correct action is to update rather than deploy compensating controls.

An attacker who holds or obtains a Contributor-level account on a site running MailerLite - Signup forms (official) <= 1.7.21 sends a request to the unprotected forms() handler of AdminController. Because the method omits a capability check, the request succeeds and the attacker creates spurious signup forms or deletes legitimate ones, disrupting the site's lead-capture and email-marketing workflow. No public exploit code was identified, and the attack requires authentication but no user interaction and only low complexity.