# Another Mailchimp Widget <= 2.1.0 - Unauthenticated Mailing List Subscription Tampering via shortcode_mailing_list_id Parameter

- **ID:** WPSEC-2026-2665
- **Plugin:** Another Mailchimp Widget (`another-mailchimp-widget`), https://wordpress.org/plugins/another-mailchimp-widget/
- **Affected versions:** all versions before 2.2.0
- **Fixed in:** 2.2.0 (Update to 2.2.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/another-mailchimp-widget
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2665/

## Description

The Another Mailchimp Widget plugin for WordPress is vulnerable to external control of assumed-immutable parameters via the public subscription handler in all versions up to, and including, 2.1.0. This is due to the handler taking the target Mailchimp list and interest group IDs from the request's shortcode_mailing_list_id parameter (whenever mp_am_type is 'shortcode') rather than from the configuration saved on the site. This makes it possible for unauthenticated attackers to subscribe arbitrary e-mail addresses (status 'subscribed' by default) to any list or interest group in the site owner's Mailchimp account whose ID they know, not only the ones offered by the site's forms.

## References

- https://wpsec.com/vuln/WPSEC-2026-2665/
- https://plugins.svn.wordpress.org/another-mailchimp-widget/tags/2.2.0/
- https://wordpress.org/plugins/another-mailchimp-widget/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2665/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.