Missing Authorization in Mailchimp for WordPress Plugin by WordPress
CVE-2026-1781

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Mc4WP: Mailchimp For WordPress
Vendor
CVE Published:
11 March 2026

What is CVE-2026-1781?

The Mailchimp for WordPress plugin is vulnerable due to improper validation of the _mc4wp_action POST parameter. This flaw allows unauthenticated attackers to exploit the plugin and unsubscribe any email address from a connected Mailchimp audience. The form ID, which is publicly accessible in the HTML source, can be used to force the plugin to carry out unsubscribe actions without any authorization, leading to potential abuse of the plugin's functionality.

Affected Version(s)

MC4WP: Mailchimp for WordPress 0 <= 4.11.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mailchimp-for-...
https://plugins.trac.wordpress.org/browser/mailchimp-for-...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sarawut Poolkhet
.