{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25420", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:53:26.262Z", "datePublished": "2026-02-19T08:27:06.988Z", "dateUpdated": "2026-04-28T16:14:58.454Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "official-mailerlite-sign-up-forms", "product": "MailerLite", "vendor": "MailerLite", "versions": [{"changes": [{"at": "1.7.19", "status": "unaffected"}], "lessThanOrEqual": "1.7.18", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:09.828Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects MailerLite: from n/a through <= 1.7.18.</p>"}], "value": "Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:58.454Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/official-mailerlite-sign-up-forms/vulnerability/wordpress-mailerlite-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:20:38.487687Z", "id": "CVE-2026-25420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T13:25:59.266Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:20:38.487687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:18:41.820Z"}}], "cna": {"title": "WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "MailerLite", "product": "MailerLite", "versions": [{"status": "affected", "changes": [{"at": "1.7.19", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 1.7.18"}], "packageName": "official-mailerlite-sign-up-forms", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-02-19T09:25:51.980Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/official-mailerlite-sign-up-forms/vulnerability/wordpress-mailerlite-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects MailerLite: from n/a through <= 1.7.18.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-02-19T08:27:06.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25420", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:22:56.041Z", "dateReserved": "2026-02-02T12:53:26.262Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:27:06.988Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n en MailerLite MailerLite official-mailerlite-sign-up-forms permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a MailerLite: desde n/a hasta &lt;= 1.7.18."}], "id": "CVE-2026-25420", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-19T09:16:23.740", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/official-mailerlite-sign-up-forms/vulnerability/wordpress-mailerlite-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.18]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.7.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MailerLite", "source": "cna", "vendor": "MailerLite"}, "product": "mailerlite", "vendor": "mailerlite"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T00:13:44.408321+00:00", "value": {"mitigation_remediation": ["Upgrade the MailerLite official\u2011mailerlite\u2011sign\u2011up\u2011forms plugin to a version newer than 1.7.18", "Review and lock down any custom roles or capabilities that interact with the plugin", "Disable or remove the plugin if it is no longer required", "Regularly check for official security advisories from the plugin maintainer"], "summary": {"action": "Apply Patch", "impact": "Broken Access Control"}, "threat_synthesis": {"affected_systems": "The issue affects the MailerLite official\u2011mailerlite\u2011sign\u2011up\u2011forms WordPress plugin from the initial release through any version 1.7.18 or earlier. All WordPress installations using this plugin version are potentially vulnerable until an up\u2011to\u2011date patch is applied.", "description_and_impact": "Missing authorization in the MailerLite official\u2011mailerlite\u2011sign\u2011up\u2011forms plugin up to version 1.7.18 permits attackers to access and manipulate protected functionality. The vulnerability, classified as CWE\u2011862, could allow an unauthenticated or low\u2011privileged user to execute actions reserved for higher\u2011privileged users, potentially exposing sensitive user data or modifying sign\u2011up form configurations. The impact is a loss of integrity and confidentiality within the WordPress site hosting the plugin.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a very low realistic exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, implying no known active exploitation. Attackers would need to target the plugin\u2019s protected endpoints, which may require some level of authentication or rely on misconfigurations that relax access control. In the absence of a public exploit, the threat remains theoretical but should be mitigated promptly to avoid potential privilege escalation if exploited in the future."}}}}, "created": "2026-02-20T10:08:18.924764+00:00", "updated": "2026-04-16T00:15:18.642231+00:00", "vendors": ["mailerlite", "mailerlite$PRODUCT$mailerlite", "wordpress", "wordpress$PRODUCT$wordpress"]}