Cross-Site Request Forgery Vulnerability in Mailchimp List Subscribe Form Plugin for WordPress
CVE-2025-12172

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Mailchimp List Subscribe Form
Vendor
CVE Published:
19 February 2026

What is CVE-2025-12172?

The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the mailchimp_sf_change_list_if_necessary() function. This vulnerability allows unauthorized attackers to manipulate Mailchimp lists by tricking site administrators into executing malicious requests, such as clicking on compromised links. All versions up to and including 2.0.0 are affected, posing a significant risk to users relying on this plugin for their mailing list management.

Affected Version(s)

Mailchimp List Subscribe Form 0 <= 2.0.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SHIVAM KUMAR
.