Description

The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-11-06T08:17:18.400Z",
  "pubdate": "2026-11-06T08:17:18.400Z",
  "executiveSummary": "The MC4WP: Mailchimp for WordPress plugin, specifically versions prior to 4.15.0, contains a critical security flaw involving improper input validation within its dynamic content tag processing logic.\nThe vulnerability manifests as a shortcode injection flaw, enabling unauthenticated remote attackers to execute arbitrary registered shortcodes on the WordPress installation.\nThe exploit is triggered when a site administrator utilizes request-derived tags within form content and renders the form using the plugin's block implementation rather than the classic shortcode mechanism.\nSuccessful exploitation allows an attacker to manipulate form input parameters to trigger malicious shortcode execution, potentially leading to unauthorized data exposure, content modification, or other side effects depending on the functionality of the active shortcodes within the environment.\nThis vulnerability highlights a critical failure in sanitizing user-controlled input before passing it to the WordPress shortcode parser.\nNo authentication is required to initiate an attack, and the primary prerequisite for exploitation is the specific configuration of the form blocks containing dynamic tags.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of request-derived values within the MC4WP plugin's dynamic content tag system. In affected versions (pre-4.15.0), the plugin fails to perform adequate sanitization or context-aware escaping on inputs derived from HTTP requests before these values are processed by the WordPress shortcode engine.\nWhen a WordPress administrator incorporates dynamic tags (e.g., tags that pull data from the global $_REQUEST array) into a form, the plugin processes these values to dynamically inject content into the form structure. However, the logic fails to account for the possibility of these request-derived values containing shortcode syntax (e.g., [shortcode_name attribute='value']).\nIf a site administrator employs the MC4WP block to embed a form, the rendering logic inadvertently allows the content processed through the dynamic tag engine to be parsed by the WordPress do_shortcode() function (or equivalent internal handler). An unauthenticated attacker can manipulate the request parameters that populate these dynamic tags to include arbitrary shortcode strings.\nThe attack flow follows these specific steps: 1) The attacker identifies a form configured with a request-derived dynamic tag. 2) The attacker crafts an HTTP request containing a malicious payload in the parameter mapped to the dynamic tag. 3) The MC4WP plugin retrieves this payload and injects it into the form structure. 4) The plugin's block-based rendering engine processes the rendered form content, which now contains the attacker's injected shortcode string. 5) The WordPress shortcode processor executes the attacker-provided shortcode with the specified attributes.\nThe impact is determined by the set of registered shortcodes available in the WordPress environment. If a plugin or theme has registered sensitive shortcodes (e.g., those providing administrative functions, database access, or file manipulation), an attacker may be able to invoke these with arbitrary attributes, leading to a significant security compromise. Because this occurs during the rendering phase within the block editor context, it bypassing standard input validation checks intended for form submissions.\nThis vulnerability is restricted to environments using the block-based embedding method; the classic shortcode method for embedding forms is documented as not being susceptible to this specific execution path, suggesting a divergence in how the block renderer handles content versus the classic method."
}