CVE-2026-3253

4.3 Moyenne

Publiée le 24/09/2026 à 14:17 · Modifiée le 24/09/2026 à 17:17 · Analyse NVD reportée · Source : security@wordfence.com

Description

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.

Traduire en français

Produits concernés

MailerLite – Signup forms (official)

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://plugins.trac.wordpress.org/changeset/3505999/
https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories