Description

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T06:16:40.710Z",
  "pubdate": "2026-11-06T06:16:40.710Z",
  "executiveSummary": "The MC4WP: Mailchimp for WordPress plugin before 4.15.0 contains an improper input validation vulnerability within its sign-up form and integration handling logic.\nThis flaw allows unauthenticated attackers to bypass intended audience constraints by manipulating request parameters during the subscription process.\nThe vulnerability exposes site owners to unauthorized list manipulation, enabling attackers to inject arbitrary email addresses into any Mailchimp audience accessible via the connected API key.\nThe risk is categorized as high, as it grants external actors the ability to abuse a site's integrated marketing infrastructure without requiring administrative access or authentication.\nThe impact includes potential spamming of unintended recipients, degradation of email list integrity, and potential financial or reputational damage associated with unauthorized list growth or compromised communication channels.",
  "technicalDetails": "The vulnerability resides in the core subscription handling mechanism of the MC4WP: Mailchimp for WordPress plugin. Specifically, the plugin fails to enforce strict server-side validation regarding the target Mailchimp 'list ID' or 'audience ID' provided during the subscription request.\nUnder normal operations, the plugin is expected to map incoming sign-up form submissions to a specific, site-owner-configured Mailchimp audience. However, the plugin logic does not verify if the list ID submitted by the user interface matches the authorized configuration stored in the plugin settings.\nAn unauthenticated attacker can intercept or construct a POST request to the plugin's subscription endpoint. By modifying the payload to include a target list ID belonging to the same Mailchimp account, the attacker can force the plugin to subscribe an arbitrary email address to an unintended audience.\nThe attack flow follows these steps: 1) The attacker identifies the API key context of the WordPress site. 2) The attacker crafts a subscription request, deliberately injecting a valid list ID that is different from the one configured in the plugin settings but still accessible via the authorized Mailchimp account. 3) The plugin processes the request and sends it to the Mailchimp API, which executes the subscription because the API key provides sufficient permissions for the specified list.\nBecause the validation is absent, the system acts as an open proxy for subscription requests, allowing the injection of emails into any list available to the connected account. This does not require any existing session, administrative privileges, or specific knowledge of the site's back-end configuration beyond identifying the target list ID.\nThe failure to validate the mapping between form source and target destination represents a significant failure in secure API integration design, effectively circumventing the security boundaries of the plugin's intended workflow.\nSuccessful exploitation results in unauthorized modification of Mailchimp audiences, enabling mass subscription of unwanted emails, which can lead to increased costs for the victim and potential blacklisting of the Mailchimp account due to high bounce rates or spam complaints."
}