Access Control Issue in Customer Engagement System Plugin for WordPress
CVE-2026-115225

Currently unrated

Key Information:

Vendor

WordPress
Status
Customer Engagement System
Vendor
CVE Published:
28 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-115225?

The Customer Engagement System plugin for WordPress prior to version 2.0.2 contains a significant access control vulnerability. This flaw allows unauthenticated users to access its MailChimp interest-group functionality. Furthermore, the plugin fails to validate the supplied API key, enabling these users to initiate connections to arbitrary internal hosts and ports. By exploiting this vulnerability, attackers can infer the reachability of internal resources based on response timing, which poses a risk to the confidentiality and integrity of the system.

Affected Version(s)

Customer Engagement System 0 < 2.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-115225 - Proof of Concept

References

https://wpscan.com/vulnerability/b91dc5fc-8b7b-4874-9e71-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.