The MailerLite – WooCommerce integration plugin for WordPress contains missing capability checks on the resetIntegration() function, allowing authenticated users with Subscriber-level access to reset integration settings, delete all plugin options, and drop the plugin’s database tables. This can result in complete loss of abandoned cart data and sync job history, effectively erasing critical e‑commerce information.

All installations of the MailerLite – WooCommerce integration plugin up to and including version 3.1.3 are affected. WordPress sites running any of these versions are at risk and should review their current plugin version.

The CVSS score of 6.5 classifies this vulnerability as moderate, while the EPSS score of less than 1 % indicates a very low probability of exploitation. The attacker only needs valid credentials with Subscriber-level permissions, a role that is commonly granted to many users, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the risk is moderate, though the likelihood of exploitation remains low compared to high‑privilege attacks.