CVE-2026-118167mediumCWE-863

CVE-2026-118167: medium-severity vulnerability in MC4WP: Mailchimp for WordPress

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

Published

Follow this CVE+ Monitor MC4WP: Mailchimp for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · MC4WP: Mailchimp for WordPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MC4WP: Mailchimp for WordPress

In the same product, most dangerous first.

CVE-2026-118166MEDIUMMC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content TagEPSS 0.2%