CVE-2026-1000

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1000", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-15T16:35:54.267Z", "datePublished": "2026-01-16T04:44:35.744Z", "dateUpdated": "2026-04-08T17:29:06.221Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:06.221Z"}, "affected": [{"vendor": "mailerlite", "product": "MailerLite \u2013 WooCommerce integration", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history."}], "title": "MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e20deec4-f40c-4bd3-91f7-6a9d643a5520?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/WooMailerLite.php#L127"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/admin/controllers/WooMailerLiteAdminSettingsController.php#L231"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/migrations/WooMailerLiteMigration.php#L33"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415073%40woo-mailerlite%2Ftrunk&old=3399626%40woo-mailerlite%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-15T16:41:53.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T16:26:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:38:02.508043Z", "id": "CVE-2026-1000", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:38:41.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T14:38:02.508043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:38:33.875Z"}}], "cna": {"title": "MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "mailerlite", "product": "MailerLite \u2013 WooCommerce integration", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-15T16:41:53.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T16:26:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e20deec4-f40c-4bd3-91f7-6a9d643a5520?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/WooMailerLite.php#L127"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/admin/controllers/WooMailerLiteAdminSettingsController.php#L231"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/migrations/WooMailerLiteMigration.php#L33"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415073%40woo-mailerlite%2Ftrunk&old=3399626%40woo-mailerlite%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:06.221Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1000", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:06.221Z", "dateReserved": "2026-01-15T16:35:54.267Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T04:44:35.744Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MailerLite \u2013 WooCommerce integration", "vendor": "mailerlite", "versions": [{"lessThanOrEqual": "3.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history."}, {"lang": "es", "value": "El plugin de integraci\u00f3n MailerLite - WooCommerce para WordPress es vulnerable a la modificaci\u00f3n y eliminaci\u00f3n no autorizadas de datos en todas las versiones hasta la 3.1.3, inclusive. Esto se debe a la falta de comprobaciones de capacidad en la funci\u00f3n resetIntegration(). Esto hace posible que atacantes autenticados, con acceso de nivel de Suscriptor y superior, restablezcan la configuraci\u00f3n de integraci\u00f3n del plugin, eliminen todas las opciones del plugin y eliminen las tablas de la base de datos del plugin (woo_mailerlite_carts y woo_mailerlite_jobs), lo que resulta en una p\u00e9rdida completa de los datos del plugin, incluyendo informaci\u00f3n de carritos abandonados de clientes e historial de trabajos de sincronizaci\u00f3n."}], "id": "CVE-2026-1000", "lastModified": "2026-06-17T10:14:49.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1000", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:38:02.508043Z", "version": "2.0.3"}}]}, "published": "2026-01-16T05:16:17.283", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/admin/controllers/WooMailerLiteAdminSettingsController.php#L231"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/WooMailerLite.php#L127"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-mailerlite/tags/3.1.3/includes/migrations/WooMailerLiteMigration.php#L33"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3415073%40woo-mailerlite%2Ftrunk&old=3399626%40woo-mailerlite%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e20deec4-f40c-4bd3-91f7-6a9d643a5520?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T17:39:26.597390+00:00", "value": {"mitigation_remediation": ["Upgrade the MailerLite \u2013 WooCommerce integration plugin to the latest version, which includes the missing authorization checks.", "Revoke or restrict Subscriber-role users from accessing the resetIntegration endpoint by adjusting role capabilities or using a plugin that enforces stricter permissions.", "If an immediate upgrade is not possible, consider disabling the integration or removing the plugin\u2019s database tables manually to prevent data loss until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Data Loss via Unauthorized Deletion"}, "threat_synthesis": {"affected_systems": "All installations of the MailerLite \u2013 WooCommerce integration plugin up to and including version 3.1.3 are affected. WordPress sites running any of these versions are at risk and should review their current plugin version.", "description_and_impact": "The MailerLite \u2013 WooCommerce integration plugin for WordPress contains missing capability checks on the resetIntegration() function, allowing authenticated users with Subscriber-level access to reset integration settings, delete all plugin options, and drop the plugin\u2019s database tables. This can result in complete loss of abandoned cart data and sync job history, effectively erasing critical e\u2011commerce information.", "risk_and_exploitability": "The CVSS score of 6.5 classifies this vulnerability as moderate, while the EPSS score of less than 1\u202f% indicates a very low probability of exploitation. The attacker only needs valid credentials with Subscriber-level permissions, a role that is commonly granted to many users, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the risk is moderate, though the likelihood of exploitation remains low compared to high\u2011privilege attacks."}}}}, "created": "2026-01-16T13:41:54.922366+00:00", "updated": "2026-04-15T18:15:10.860025+00:00", "vendors": ["mailerlite", "mailerlite$PRODUCT$mailerlite", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}