Description

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T07:16:34.333Z",
  "pubdate": "2026-09-19T07:16:34.333Z",
  "executiveSummary": "The Mailchimp for WooCommerce WordPress plugin contains a critical broken access control vulnerability originating from missing permission checks within its REST API implementation.\nThis flaw allows unauthenticated remote attackers to interact with administrator-oriented endpoints, effectively bypassing the WordPress security model.\nBy failing to validate user capabilities within the permission callback functions for specific REST API routes, the plugin exposes sensitive administrative functionality to the public web.\nThe impact of this vulnerability is severe, as it allows unauthorized actors to trigger persistent state changes within the target WordPress environment.\nThis vulnerability affects versions of Mailchimp for WooCommerce prior to 6.1.1. The risk profile is high, as exploitation does not require prior authentication or elevated privileges, making it accessible to any unauthenticated actor capable of sending HTTP requests to the REST API.\nSuccessful exploitation can lead to unauthorized configuration changes or other persistent modifications to the site, potentially facilitating further compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WordPress REST API endpoints within the Mailchimp for WooCommerce plugin. When registering custom REST API routes via register_rest_route(), developers must define a 'permission_callback' to ensure that only users with the appropriate capabilities (e.g., 'manage_options' or 'administrator' roles) can access the defined functionality.\nIn the affected versions prior to 6.1.1, several internal API routes fail to perform these mandatory authorization checks. Consequently, the 'permission_callback' for these routes either returns 'true' regardless of the user's session status or fails to execute the necessary current_user_can() checks, thereby treating every incoming request as authorized.\nThe attack flow begins with the attacker identifying the exposed REST API endpoints registered by the plugin. Since the plugin's API routes are publicly discoverable via the WordPress REST API index, an attacker can map the available endpoints. By crafting malicious HTTP requests targeting these specific routes, the attacker bypasses the intended authorization gate.\nUpon reaching the endpoint, the server executes the associated handler function. Because the security check has been circumvented, the plugin logic processes the request as if it were issued by an authenticated administrator. This permits the attacker to execute backend functions that modify plugin settings, alter data structures, or trigger state-changing operations within the WooCommerce ecosystem.\nThe vulnerability is primarily characterized as a Broken Access Control issue (CWE-285/CWE-862). The lack of input validation regarding user permissions means that the underlying state-changing functions are invoked without verifying the identity or authorization level of the requester. Post-exploitation, an attacker can maintain persistence or disrupt site operations by manipulating administrative data through these unprotected API routes.\nThe scope of impact is limited by the specific functionality exposed by the vulnerable endpoints; however, because these endpoints were designed for administrative use, the potential for unauthorized data modification is high. Exploitation is trivial, requiring only standard HTTP client tools to send requests to the vulnerable API path, bypassing all authentication and privilege barriers previously assumed by the plugin architecture."
}