CVE-2026-1000 is a missing authorization vulnerability (CWE-862) in the MailerLite – WooCommerce integration plugin for WordPress. The issue arises from missing capability checks in the resetIntegration() function, allowing authenticated users with low privileges (Subscriber-level and above) to reset the plugin's integration settings, delete all plugin options, and drop critical plugin database tables (woo_mailerlite_carts and woo_mailerlite_jobs). This leads to complete loss of plugin data, including customer abandoned cart data and synchronization job history. The vulnerability affects all versions up to and including 3.1.3. There is no information about an available patch or vendor advisory, and no known exploits in the wild have been reported.

Exploitation allows authenticated users with Subscriber-level access or higher to cause unauthorized data modification and deletion within the plugin. This results in loss of critical plugin data such as abandoned cart information and sync job history, potentially disrupting e-commerce operations relying on this plugin. There is no direct confidentiality or availability impact reported, but integrity of plugin data is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users. Review plugin updates regularly for a security patch addressing this issue.