Arbitrary Email Subscription Issue in Mailchimp for WordPress Plugin by Mailchimp
CVE-2026-118167
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118167?
The Mailchimp for WordPress plugin prior to version 4.15.0 has a security flaw where it fails to properly validate the Mailchimp audience associated with email sign-up forms. This oversight permits unauthenticated individuals to subscribe any email address to audiences in the connected Mailchimp account, rather than restricting access to the intended audience set by the site owner. This vulnerability raises significant concerns over data integrity and unauthorized access to email subscription lists.
Affected Version(s)
MC4WP: Mailchimp for WordPress 0 < 4.15.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.