Vulnerabilities / Magical Addons For Elementor / WPSEC-2026-1238
Magical Addons For Elementor < 1.5.3 - Unauthenticated Sensitive Information Exposure via Mailchimp API Key
Medium 5.3
CWE-200Fixed in 1.5.3
- ID
- WPSEC-2026-1238
- Plugin
- Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) (magical-addons-for-elementor)
- Affected
- from 1.1.6 before 1.5.3
- Remediation
- Update to 1.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-19
- Attack surface
- Magical Addons For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Mailchimp widget in versions 1.1.6 through 1.5.2, due to the site's Mailchimp API key being output in the widget's frontend HTML data attributes. This makes it possible for unauthenticated attackers to retrieve the site's Mailchimp API key from any page using the Mailchimp widget and use it to access the connected Mailchimp account.
References
- https://wpsec.com/vuln/WPSEC-2026-1238/
- https://plugins.svn.wordpress.org/magical-addons-for-elementor/tags/1.5.3/
- https://wordpress.org/plugins/magical-addons-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS