CVE-2026-1000: 
WordPress vulnerability analysis and mitigation

CVE-2026-1000 is a Missing Authorization vulnerability in the MailerLite – WooCommerce Integration plugin for WordPress, allowing authenticated attackers with Subscriber-level access or above to perform unauthorized data modification and deletion. It affects all plugin versions up to and including 3.1.3. The vulnerability was published on January 16, 2026, with the CVE record sourced from Wordfence. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the resetIntegration() function within the plugin's admin settings controller (WooMailerLiteAdminSettingsController.php, line 231). Because no authorization check validates whether the calling user has sufficient privileges, any authenticated WordPress user — including those with the default Subscriber role — can invoke this function via a network request. Exploitation requires only a valid low-privilege WordPress account and no user interaction. The vulnerable code paths are publicly visible in the plugin's SVN repository, including WooMailerLite.php (line 127) and WooMailerLiteMigration.php (line 33) (Wordfence, WordPress SVN).

Successful exploitation results in complete loss of plugin data: an attacker can reset all MailerLite–WooCommerce integration settings, delete all plugin options, and drop the woo_mailerlite_carts and woo_mailerlite_jobs database tables. This causes permanent destruction of customer abandoned cart information and email sync job history, directly impacting e-commerce operations and marketing automation workflows. There is no confidentiality impact (no data exfiltration), but the integrity and availability of plugin-managed data are fully compromised (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low privilege requirement (Subscriber-level) and straightforward exploitation mechanism make it accessible to any registered WordPress user on an affected site (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the MailerLite – WooCommerce Integration plugin version 3.1.3 or earlier. This can be done by checking the plugin's readme or version file at wp-content/plugins/woo-mailerlite/readme.txt.
2. Obtain low-privilege account: Register or obtain credentials for any WordPress account with at least Subscriber-level access on the target site (e.g., via open user registration).
3. Authenticate: Log in to the WordPress site using the low-privilege account to obtain a valid session cookie or nonce.
4. Invoke the vulnerable function: Send an authenticated HTTP POST request to the WordPress admin AJAX endpoint (e.g., wp-admin/admin-ajax.php) or the relevant REST/admin action that triggers resetIntegration(), without any additional authorization parameters required.
5. Achieve data destruction: The resetIntegration() function executes without authorization checks, resetting all plugin settings, deleting all plugin options, and dropping the woo_mailerlite_carts and woo_mailerlite_jobs database tables, resulting in permanent data loss (Wordfence, WordPress SVN).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or admin pages triggering the resetIntegration action from low-privilege user accounts; unexpected admin activity from Subscriber-role users in WordPress audit logs.
• Database: Absence of the woo_mailerlite_carts and woo_mailerlite_jobs tables in the WordPress database; deletion of all rows in the wp_options table associated with the woo-mailerlite plugin prefix.
• File System: No direct file-system artifacts expected, but plugin configuration files or cached settings may be cleared or reset to defaults.
• Application Behavior: MailerLite–WooCommerce integration appearing unconfigured or disconnected; loss of abandoned cart tracking data and email sync history visible in the WooCommerce admin dashboard (Wordfence).

WordPress site administrators should update the MailerLite – WooCommerce Integration plugin to version 3.1.4 or later, which introduces proper capability checks on the resetIntegration() function. The patch is available via the WordPress plugin repository changeset (WordPress SVN Changeset). As an interim workaround, administrators can disable open user registration or restrict Subscriber-level access on the site to reduce the attack surface until the update is applied (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 16, 2026. It was noted on Bluesky via the CVE tracking account and picked up by several vulnerability aggregators including VulDB, Vulners, and CIRCL. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts. No significant broader media coverage or notable researcher commentary beyond standard aggregation has been identified (Wordfence, Red Hat CVE).