{
 "id": "WPSEC-2026-2463",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2463/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2463/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2463/index.md",
 "title": "MC4WP: Mailchimp for WordPress <= 4.14.1 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tags",
 "description": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via dynamic content tags in versions 4.4.0 up to, and including, 4.14.1. This is due to replacement values, including request data returned by the {data key=\"...\"} tag, keeping their square brackets. When a sign-up form is shown with the form block, the rendered form is part of the post content that WordPress then runs through do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites that display, through the form block, a sign-up form containing a {data} tag.",
 "plugin": {
  "slug": "mailchimp-for-wp",
  "name": "MC4WP: Mailchimp for WordPress",
  "full_name": "MC4WP: Mailchimp for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/mailchimp-for-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailchimp-for-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailchimp-for-wp"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.4.0",
    "from_inclusive": true,
    "to": "4.15.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.4.0 before 4.15.0"
  ]
 },
 "introduced_in": "4.4.0",
 "fixed_in": "4.15.0",
 "remediation": "Update to 4.15.0 or later.",
 "fix_released": "2026-11-03T10:05:41+00:00",
 "published": "2026-11-04T10:54:55+00:00",
 "updated": "2026-11-03T13:31:15.450790+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2463/",
  "https://plugins.svn.wordpress.org/mailchimp-for-wp/tags/4.15.0/",
  "https://wordpress.org/plugins/mailchimp-for-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailchimp-for-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-04"
 }
}