Authentication Bypass in Mailchimp for WooCommerce Plugin by WordPress
CVE-2026-92436
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 September 2026
Badges
What is CVE-2026-92436?
The Mailchimp for WooCommerce plugin prior to version 6.3 is susceptible to an authentication bypass vulnerability. This issue arises from the plugin's failure to require proper authentication or verify ownership when loading a saved cart using a request-supplied identifier linked to a customer's email address. Consequently, an unauthenticated attacker aware of a customer's email address can access the customer's saved cart details and, by extension, confirm their shopping activity at the store. This vulnerability poses a significant risk by exposing sensitive customer data without any requisite verification.
Affected Version(s)
Mailchimp for WooCommerce 0 < 6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.