Vulnerabilities / Another Mailchimp Widget / WPSEC-2026-2664
Another Mailchimp Widget <= 2.1.0 - Improper Certificate Validation in Mailchimp API Requests
Medium 5.9
CWE-295Fixed in 2.2.0
- ID
- WPSEC-2026-2664
- Plugin
- Another Mailchimp Widget (another-mailchimp-widget)
- Affected
- all versions before 2.2.0
- Remediation
- Update to 2.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-295
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Another Mailchimp Widget on WPSec AttackSurface
- Fix released
- Published
Description
The Another Mailchimp Widget plugin for WordPress is vulnerable to improper certificate validation in all versions up to, and including, 2.1.0 due to TLS certificate verification being disabled ('sslverify' => false) for Mailchimp API requests that carry the API key in an HTTP Basic authorization header. This makes it possible for unauthenticated attackers in a man-in-the-middle network position to intercept these requests and steal the site's Mailchimp API key.
References
- https://wpsec.com/vuln/WPSEC-2026-2664/
- https://plugins.svn.wordpress.org/another-mailchimp-widget/tags/2.2.0/
- https://wordpress.org/plugins/another-mailchimp-widget/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS