CVE-2022-2267: vulnerability in Mailchimp for WooCommerce
MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.7%
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
Affected products
Unknown · Mailchimp for WooCommerceRelated CVEs — Mailchimp for WooCommerce
In the same product, most dangerous first.
CVE-2022-2556—MailChimp for Woocommerce < 2.7.2 - Admin+ SSRFEPSS 0.8%CVE-2026-92435MEDIUMMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST APIEPSS 0.3%CVE-2026-92436MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOREPSS 0.3%CVE-2026-92437MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionEPSS 0.2%