Mailerlite Signup Forms Official
Monthly
Missing capability checks in the MailerLite - Signup forms (official) WordPress plugin, in all versions up to and including 1.7.21, allow authenticated attackers holding Contributor-level access or higher to create or delete arbitrary signup forms on the affected site. The flaw sits in the forms() method of the AdminController class, which is reachable without verifying that the caller has the capability normally required to manage plugin forms, so any Contributor account is sufficient and no further user interaction is needed. Impact is limited to data integrity - attackers can add or remove form definitions but cannot read data, escalate privileges, or cause site-wide denial of service - and this is a low-severity, routine-patching issue rather than an emergency; no public exploit identified at time of analysis and no CISA KEV listing.
Missing capability checks in the MailerLite - Signup forms (official) WordPress plugin, in all versions up to and including 1.7.21, allow authenticated attackers holding Contributor-level access or higher to create or delete arbitrary signup forms on the affected site. The flaw sits in the forms() method of the AdminController class, which is reachable without verifying that the caller has the capability normally required to manage plugin forms, so any Contributor account is sufficient and no further user interaction is needed. Impact is limited to data integrity - attackers can add or remove form definitions but cannot read data, escalate privileges, or cause site-wide denial of service - and this is a low-severity, routine-patching issue rather than an emergency; no public exploit identified at time of analysis and no CISA KEV listing.