{
 "id": "WPSEC-2026-1238",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1238/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1238/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1238/index.md",
 "title": "Magical Addons For Elementor < 1.5.3 - Unauthenticated Sensitive Information Exposure via Mailchimp API Key",
 "description": "The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Mailchimp widget in versions 1.1.6 through 1.5.2, due to the site's Mailchimp API key being output in the widget's frontend HTML data attributes. This makes it possible for unauthenticated attackers to retrieve the site's Mailchimp API key from any page using the Mailchimp widget and use it to access the connected Mailchimp account.",
 "plugin": {
  "slug": "magical-addons-for-elementor",
  "name": "Magical Addons For Elementor",
  "full_name": "Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )",
  "wordpress_org": "https://wordpress.org/plugins/magical-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/magical-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/magical-addons-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.1.6",
    "from_inclusive": true,
    "to": "1.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.1.6 before 1.5.3"
  ]
 },
 "introduced_in": "1.1.6",
 "fixed_in": "1.5.3",
 "remediation": "Update to 1.5.3 or later.",
 "fix_released": "2026-10-18T05:05:55+00:00",
 "published": "2026-10-19T05:45:14+00:00",
 "updated": "2026-10-18T11:09:26.265296+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1238/",
  "https://plugins.svn.wordpress.org/magical-addons-for-elementor/tags/1.5.3/",
  "https://wordpress.org/plugins/magical-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/magical-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-19"
 }
}