Another Mailchimp Widget <= 2.1.0 - Unauthenticated Mailing List Subscription Tampering via shortcode_mailing_list_id Parameter
- ID
- WPSEC-2026-2665
- Plugin
- Another Mailchimp Widget (another-mailchimp-widget)
- Affected
- all versions before 2.2.0
- Remediation
- Update to 2.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Another Mailchimp Widget on WPSec AttackSurface
- Fix released
- Published
Description
The Another Mailchimp Widget plugin for WordPress is vulnerable to external control of assumed-immutable parameters via the public subscription handler in all versions up to, and including, 2.1.0. This is due to the handler taking the target Mailchimp list and interest group IDs from the request's shortcode_mailing_list_id parameter (whenever mp_am_type is 'shortcode') rather than from the configuration saved on the site. This makes it possible for unauthenticated attackers to subscribe arbitrary e-mail addresses (status 'subscribed' by default) to any list or interest group in the site owner's Mailchimp account whose ID they know, not only the ones offered by the site's forms.
References
- https://wpsec.com/vuln/WPSEC-2026-2665/
- https://plugins.svn.wordpress.org/another-mailchimp-widget/tags/2.2.0/
- https://wordpress.org/plugins/another-mailchimp-widget/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS