WordPress Plugin Vulnerabilities

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

Description

The plugin does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.

Proof of Concept

Affects Plugins

Fixed in 4.15.0

References

Classification

Type
INCORRECT AUTHORISATION
CWE

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes

Timeline

Publicly Published
2026-11-04 (about 2 days ago)
Added
2026-11-04 (about 1 day ago)
Last Updated
2026-11-04 (about 1 day ago)

Other