MC4WP: Mailchimp for WordPress <= 4.14.1 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tags
- ID
- WPSEC-2026-2463
- Plugin
- MC4WP: Mailchimp for WordPress (mailchimp-for-wp)
- Affected
- from 4.4.0 before 4.15.0
- Remediation
- Update to 4.15.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-04
- Attack surface
- MC4WP: Mailchimp for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via dynamic content tags in versions 4.4.0 up to, and including, 4.14.1. This is due to replacement values, including request data returned by the {data key="..."} tag, keeping their square brackets. When a sign-up form is shown with the form block, the rendered form is part of the post content that WordPress then runs through do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites that display, through the form block, a sign-up form containing a {data} tag.
References
- https://wpsec.com/vuln/WPSEC-2026-2463/
- https://plugins.svn.wordpress.org/mailchimp-for-wp/tags/4.15.0/
- https://wordpress.org/plugins/mailchimp-for-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS