CVE-2022-33201: WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-05 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

Affected products

MailerLite (WordPress plugin): before 1.5.8 — fixed in 1.5.8

How to fix

Upgrade to a fixed version: MailerLite (WordPress plugin) 1.5.8. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/vulnerability/official-mailerlite-sign-up-forms/wordpress-mailerlite-signup-forms-official-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability
https://wordpress.org/plugins/official-mailerlite-sign-up-forms/#developers
https://patchstack.com/database/vulnerability/official-mailerlite-sign-up-forms/wordpress-mailerlite-signup-forms-official-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability
https://wordpress.org/plugins/official-mailerlite-sign-up-forms/#developers

Get alerted when CVE-2022-33201 or the next vulnerability affects your stack