Missing authorization in the MailerLite official‑mailerlite‑sign‑up‑forms plugin up to version 1.7.18 permits attackers to access and manipulate protected functionality. The vulnerability, classified as CWE‑862, could allow an unauthenticated or low‑privileged user to execute actions reserved for higher‑privileged users, potentially exposing sensitive user data or modifying sign‑up form configurations. The impact is a loss of integrity and confidentiality within the WordPress site hosting the plugin.

The issue affects the MailerLite official‑mailerlite‑sign‑up‑forms WordPress plugin from the initial release through any version 1.7.18 or earlier. All WordPress installations using this plugin version are potentially vulnerable until an up‑to‑date patch is applied.

The CVSS base score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a very low realistic exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, implying no known active exploitation. Attackers would need to target the plugin’s protected endpoints, which may require some level of authentication or rely on misconfigurations that relax access control. In the absence of a public exploit, the threat remains theoretical but should be mitigated promptly to avoid potential privilege escalation if exploited in the future.