CVE-2026-92435: medium-severity vulnerability in Mailchimp for WooCommerce
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Mailchimp for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/4b3f9c83-8986-40d9-ab1a-848550ea7882/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Mailchimp for WooCommerce
In the same product, most dangerous first.
CVE-2022-2556—MailChimp for Woocommerce < 2.7.2 - Admin+ SSRFEPSS 0.8%CVE-2022-2267—MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRFEPSS 0.7%CVE-2026-92436MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOREPSS 0.3%CVE-2026-92437MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionEPSS 0.2%