PT-2026-24546 · WordPress+1 · Mc4Wp: Mailchimp For Wordpress+1

Sarawut Poolkhet · Published 2026-03-11 · Updated 2026-03-11 · CVE-2026-1781

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MC4WP: Mailchimp for WordPress plugin versions prior to 4.11.2

Description The MC4WP: Mailchimp for WordPress plugin for WordPress is susceptible to unauthorized access. The plugin improperly validates the mc4wp action POST parameter, allowing unauthenticated attackers to manipulate form processing. Specifically, attackers can force unsubscribe actions instead of subscribe actions. This allows arbitrary email addresses to be unsubscribed from the connected Mailchimp audience if the attacker can determine the form ID, which is exposed in the HTML source. The vulnerable parameter is mc4wp action.

Recommendations Update MC4WP: Mailchimp for WordPress plugin to version 4.11.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1781

Affected Products

Mc4Wp: Mailchimp For Wordpress

Mailchimp

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-1781 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1781 · Vendor Advisory
• https://github.com/ibericode/mailchimp-for-wordpress/commit/5fdebc2a5e22d11287d011697a6b09331bd96fa5 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3477825%40mailchimp-for-wp%2Ftrunk&old=3443118%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form.php#L461 · Note
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L207 · Note
• https://twitter.com/CVEnew/status/2031597273931723105 · Twitter Post
• https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L53 · Note
• https://t.me/CVEtracker/47062 · Telegram Post
• https://cwe.mitre.org/data/definitions/862.html · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=cve · Note
• https://t.me/cveNotify/155026 · Telegram Post