# MC4WP: Mailchimp for WordPress <= 4.14.1 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tags

- **ID:** WPSEC-2026-2463
- **Plugin:** MC4WP: Mailchimp for WordPress (`mailchimp-for-wp`), https://wordpress.org/plugins/mailchimp-for-wp/
- **Affected versions:** from 4.4.0 before 4.15.0
- **Fixed in:** 4.15.0 (Update to 4.15.0 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailchimp-for-wp
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2463/

## Description

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via dynamic content tags in versions 4.4.0 up to, and including, 4.14.1. This is due to replacement values, including request data returned by the {data key="..."} tag, keeping their square brackets. When a sign-up form is shown with the form block, the rendered form is part of the post content that WordPress then runs through do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites that display, through the form block, a sign-up form containing a {data} tag.

## References

- https://wpsec.com/vuln/WPSEC-2026-2463/
- https://plugins.svn.wordpress.org/mailchimp-for-wp/tags/4.15.0/
- https://wordpress.org/plugins/mailchimp-for-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2463/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.