Unauthorized Configuration Changes in MailerLite Signup Forms Plugin for WordPress

CVE-2024-2797

What is CVE-2024-2797?

The MailerLite Signup Forms plugin for WordPress is affected by a security flaw that allows unauthenticated users to make unauthorized changes to plugin settings. This vulnerability arises from inadequate capability checks in the functions responsible for managing user roles and permissions, specifically in versions 1.7.6 and earlier. This oversight can enable attackers to alter forms and permissions, potentially compromising user data and plugin integrity.

References