{"schema":"threatline.record/2","record":{"id":"CVE-2026-3253","aliases":[],"summary":"MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion","details":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.","categories":["Unclassified"],"product":"MailerLite – Signup forms (official)","vendor":"mailerlite","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-3253","source_modified_at":"2026-09-24T14:34:00.566Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"MailerLite – Signup forms (official)","vendor":"mailerlite","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.7.21","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00161,"percentile":0.0496,"score_date":"2026-10-23"},"published_at":"2026-09-24T11:31:08.940Z","modified_at":"2026-09-24T14:34:00.566Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-3253","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-24T14:34:00.566Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-3253","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3505999/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-24T14:33:53.170720Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-24T14:34:00.566Z","content_hash":"211eb97b0849f973c593473584a156b5b5883c4455757b2f4667f5a9b1c39c46"}}