What the vulnerability does
01Description
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history.
Explanation of Vulnerability in Simple Terms
02Summary
The MailerLite WooCommerce integration plugin through version 3.1.3 fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data or settings they should not have access to. The vulnerability does not affect data confidentiality or site availability, but can lead to unauthorized changes in WooCommerce or MailerLite integration settings.
What an attacker can do
03Attacker Capabilities
Modify WooCommerce or MailerLite integration settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users could alter email marketing settings, customer data mappings, or integration configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site (e.g., subscriber or customer role).
Key dates
06Disclosure timeline
January 16, 2026
CVE published
April 8, 2026
Record updated
