Description

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-13T14:17:12.880Z",
  "pubdate": "2026-08-13T14:17:12.880Z",
  "executiveSummary": "An administrator-level SQL Injection vulnerability has been identified in the MailChimp For WooCommerce plugin affecting versions prior to 6.2. This security flaw enables authenticated attackers possessing administrator privileges to inject malicious SQL statements into database queries executed by the application.\nThe primary impact of this vulnerability includes unauthorized database access, potential data exfiltration, manipulation of database contents, and compromise of the underlying web application architecture. Given the requisite administrative privilege level, an attacker must first obtain high-level access to the WordPress dashboard to execute the malicious payload.\nThe risk implications are severe for multi-site or enterprise environments where administrative segregation is critical, as a compromised administrator account can leverage this SQL injection vector to escalate capabilities, read sensitive tables including user credentials, or execute arbitrary database commands. Mitigation requires updating the MailChimp For WooCommerce plugin to version 6.2 or later where input sanitization and parameterization controls have been properly implemented.",
  "technicalDetails": "The vulnerability resides in the MailChimp For WooCommerce plugin for WordPress, specifically affecting all versions prior to 6.2. The root cause of the security defect stems from insufficient input validation and improper sanitization of parameters incorporated directly into database queries without adequate use of prepared statements or parameterization.\nThe vulnerable component processes administrative requests where user-supplied input is concatenated directly into SQL queries executed against the WordPress database via the underlying database abstraction layer. Because the application fails to properly sanitize or bind these inputs, an authenticated user with administrative privileges can supply specially crafted strings containing SQL syntax.\nThe attack flow proceeds as follows: First, the attacker authenticates to the WordPress administration panel using valid administrator credentials. Second, the attacker navigates to or interacts with the vulnerable administrative endpoint or AJAX action handled by the MailChimp For WooCommerce plugin. Third, the attacker transmits a malicious HTTP request containing a specially crafted payload designed to manipulate the intended SQL query logic. Fourth, the vulnerable component processes the input and concatenates it into the dynamic SQL statement executed by the database management system.\nPost-exploitation impact includes the ability to perform UNION-based, boolean-based, or time-based blind SQL injection attacks, allowing the retrieval of sensitive database contents such as password hashes, user metadata, and configuration settings. In certain database configurations, this flaw could theoretically facilitate further interaction with the underlying operating system depending on database privileges."
}