CVE-2023-52223 MEDIUM

CVE-2023-52223: WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Mailerlite
Product MailerLite – WooCommerce integration
Weakness CWE-352 · CSRF
Published February 28, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

Explanation of Vulnerability in Simple Terms

02Summary

The MailerLite WooCommerce integration plugin through version 2.0.8 is vulnerable to cross-site request forgery (CSRF). An attacker can trick a logged-in site administrator into performing unintended actions by crafting a malicious link or page. The vulnerability requires user interaction—the admin must visit the attacker's page while logged into WordPress. This can lead to unauthorized changes to plugin settings or WooCommerce configuration.

What an attacker can do

03Attacker Capabilities

Trick an admin into performing unintended actions on the site via a malicious link or page.

Potential impact on your site

04Site Impact

Unauthorized changes to MailerLite or WooCommerce settings if an admin is socially engineered.

Conditions required to exploit

05Prerequisites

Admin must be logged into WordPress and visit attacker-controlled content.

Key dates

06Disclosure timeline

February 28, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8939 Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-8422 Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update CVE-2026-8904 FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save CVE-2026-57766 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-8942 MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page