WordPress Plugin Vulnerabilities

Block for Mailchimp – Add Email Subscription Forms and Collect Leads < 1.1.16 - Missing Authorization

Description

The Block for Mailchimp – Add Email Subscription Forms and Collect Leads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.15. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
block-for-mailchimp
Fixed in 1.1.16

References

CVE
CVE-2026-56063
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/166dfe2c-6efd-48ad-bbcd-e3dc0e9ede05

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Nguyen Quang Truong
Verified
No
WPVDB ID
606fc21e-7f6d-4fee-a46c-511bbbfb880a

Timeline

Publicly Published
2026-06-25 (about 1 month ago)
Added
2026-06-29 (about 1 month ago)
Last Updated
2026-06-29 (about 1 month ago)

Other

Published
Title
Published
2023-10-11
Title
AI ChatBot < 4.9.1 - Missing authorization in AJAX calls
Published
2026-02-10
Title
Invoct – PDF Invoices & Billing for WooCommerce < 1.7 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Published
2024-04-22
Title
WordPress Meta Data and Taxonomies Filter (MDTF) < 1.3.3.1 - Missing Authorization
Published
2026-07-22
Title
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.6.8 - Missing Authorization
Published
2024-09-25
Title
Download Monitor < 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Shop Enable