# ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.9 - Unauthenticated Missing Authorization to Mailchimp List Subscription Manipulation via 'listed' and 'double_opt_in' Parameters

- **ID:** WPSEC-2026-2289
- **Plugin:** ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (`elementskit-lite`), https://wordpress.org/plugins/elementskit-lite/
- **Affected versions:** all versions before 4.1.0
- **Fixed in:** 4.1.0 (Update to 4.1.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/elementskit-lite
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2289/

## Description

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the Mailchimp widget subscribe REST endpoint in all versions up to, and including, 4.0.9 due to the endpoint trusting the Mailchimp list ID, the double opt-in flag and arbitrary merge field names supplied in the request instead of the widget's configured settings. This makes it possible for unauthenticated attackers to use the site's stored Mailchimp API key to add arbitrary email addresses to any audience on the connected Mailchimp account, bypass double opt-in so contacts are marked as subscribed, and set arbitrary merge field values.

## References

- https://wpsec.com/vuln/WPSEC-2026-2289/
- https://plugins.svn.wordpress.org/elementskit-lite/tags/4.1.0/
- https://wordpress.org/plugins/elementskit-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2289/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.