CVE-2023-52227 MEDIUM

CVE-2023-52227: WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability

Vendor Mailerlite
Product MailerLite – WooCommerce integration
Weakness CWE-862 · Missing authorization
Published June 11, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

Explanation of Vulnerability in Simple Terms

02Summary

The MailerLite WooCommerce integration plugin through version 2.0.8 fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data they should not have access to, such as integration settings or subscriber information. The vulnerability requires an active user account but no special role or admin status.

What an attacker can do

03Attacker Capabilities

Modify WooCommerce integration settings or subscriber data without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users could alter MailerLite integration configuration or manipulate subscriber records, potentially disrupting email campaigns or data integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level access to the WordPress site.

Key dates

06Disclosure timeline

June 11, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57340 WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability CVE-2026-13468 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability