The MailerLite – Signup forms (official) plugin contains a missing capability check that allows any authenticated user with Contributor-level access or higher to create or delete signup forms. This flaw permits an attacker to add malicious forms that can be used for phishing or other social engineering attacks, or to remove legitimate forms and disrupt marketing and communication workflows. The weakness, identified as CWE-862, enables data tampering confined to the scope of the WordPress installation where the plugin resides.

WordPress installations running the MailerLite – Signup forms (official) plugin version 1.7.21 or earlier are impacted. The vulnerability exists in all releases up to %1.7.21,& the vendor has indicated that later versions contain the fix.

The CVSS score of 4.3 classifies the vulnerability as low‑severity, and the EPSS metric is not available. Because the flaw requires authenticated access, the attack vector is limited to users who can log into the WordPress admin interface, with Contributor or higher privileges. No remote code execution or privilege escalation beyond that level is possible. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. Nonetheless, an attacker with legitimate access could still disrupt critical marketing forms, so the risk is considered moderate within environments where marketing data integrity is essential.