CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.

An attacker with basic editing privileges can modify or delete signup forms, potentially disrupting marketing data collection and leading to data loss. This may also be used to inject unwanted content into the site.

Update the MailerLite – Signup forms plugin to a version later than 1.7.21 and review Contributor user roles and permissions on the WordPress site.