{
 "id": "WPSEC-2026-2289",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2289/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2289/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2289/index.md",
 "title": "ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.9 - Unauthenticated Missing Authorization to Mailchimp List Subscription Manipulation via 'listed' and 'double_opt_in' Parameters",
 "description": "The ElementsKit Elementor Addons plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the Mailchimp widget subscribe REST endpoint in all versions up to, and including, 4.0.9 due to the endpoint trusting the Mailchimp list ID, the double opt-in flag and arbitrary merge field names supplied in the request instead of the widget's configured settings. This makes it possible for unauthenticated attackers to use the site's stored Mailchimp API key to add arbitrary email addresses to any audience on the connected Mailchimp account, bypass double opt-in so contacts are marked as subscribed, and set arbitrary merge field values.",
 "plugin": {
  "slug": "elementskit-lite",
  "name": "ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor",
  "full_name": "ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/elementskit-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/elementskit-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/elementskit-lite"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.0",
 "remediation": "Update to 4.1.0 or later.",
 "fix_released": "2026-11-02T10:38:44+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:31:12.626272+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2289/",
  "https://plugins.svn.wordpress.org/elementskit-lite/tags/4.1.0/",
  "https://wordpress.org/plugins/elementskit-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/elementskit-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}