PT-2026-24546 · WordPress+1 · Mc4Wp: Mailchimp For Wordpress+1

Sarawut Poolkhet · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2026-1781

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MC4WP: Mailchimp for WordPress plugin versions prior to 4.11.2

Description The MC4WP: Mailchimp for WordPress plugin for WordPress is susceptible to unauthorized access. The plugin improperly validates the mc4wp action POST parameter, allowing unauthenticated attackers to manipulate form processing. Specifically, attackers can force unsubscribe actions instead of subscribe actions. This allows arbitrary email addresses to be unsubscribed from the connected Mailchimp audience if the attacker can determine the form ID, which is exposed in the HTML source. The vulnerable parameter is mc4wp action.

Recommendations Update MC4WP: Mailchimp for WordPress plugin to version 4.11.2 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1781

Produtos afetados

Mc4Wp: Mailchimp For Wordpress

Mailchimp

Referências · 12

• https://github.com/ibericode/mailchimp-for-wordpress/commit/5fdebc2a5e22d11287d011697a6b09331bd96fa5 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3477825%40mailchimp-for-wp%2Ftrunk&old=3443118%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form.php#L461 · Nota
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L207 · Nota
• https://twitter.com/CVEnew/status/2031597273931723105 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L53 · Nota
• https://t.me/CVEtracker/47062 · Publicação no Telegram
• https://cwe.mitre.org/data/definitions/862.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1781 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=cve · Nota
• https://t.me/cveNotify/155026 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-1781 · Aviso do Fabricante