CVE-2023-52223 is a medium severity (5.4) cross-site request forgery in the MailerLite WooCommerce integration WordPress plugin, affecting version 2.0.8 and earlier. The developer fixed it in version 2.0.9. Update the plugin to 2.0.9 or later, and if you cannot update, deactivate it until you can.
What's affected
The NVD record names MailerLite and the MailerLite WooCommerce integration plugin for WordPress, from the earliest release through 2.0.8. Patchstack lists 2.0.9 as the patched version. Upgrade to 2.0.9 or any later release.
The weakness is CWE-352, cross-site request forgery. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, which gives 5.4 (Medium).
Patchstack lists the required privilege as unauthenticated. No account is needed, but a logged in user must be tricked. The vector gives a low integrity and low availability effect. The Patchstack page address mentions 2.0.7, while its text and the NVD record both say 2.0.8 and earlier. I use 2.0.8.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get woo-mailerlite
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 2.0.8 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Update MailerLite WooCommerce integration to 2.0.9 or later on staging first if you test changes, then on production.
- If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
- Review recent activity: check your MailerLite connection and WooCommerce integration settings for anything you did not set.
- Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.
Why it matters
Cross-site request forgery works because the browser attaches the visitor's login cookie to any request sent to your site, including one triggered from a page the attacker controls. If a plugin accepts a state changing request without checking a secret token, the request is treated as a deliberate action by the logged in user.
The attack needs a person with the right privileges to be lured into visiting a page or clicking a link, which is why the score is modest. It is still worth closing, because administrators browse the web while logged in to their sites. Integration plugins hold API keys for outside services, so a settings change can matter more than the score suggests. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Quick check
Which versions does CVE-2023-52223 affect?
The NVD record and the Patchstack text say 2.0.8 and earlier, with 2.0.9 as the patched release. The Patchstack page address mentions 2.0.7, so confirm the version in the plugin changelog.
Is there a patched version?
Yes. Patchstack lists 2.0.9 as the patched release for versions up to 2.0.8. Check the plugin's own changelog before you upgrade.
Sources
Last reviewed: 19 October 2026.
