Live › vulnerability › CVE-2026-115225
Go to dashboardThe Customer Engagement System WordPress plugin before 2.0.2 exposes its MailChimp interest-group lookup without authentication and does not validate the supplied API key. An unauthenticated attacker can make the server open connections to arbitrary internal hosts and ports and infer which are reachable from response timing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Customer Engagement System WordPress plugin before version 2.0.2 are exposed, since the vulnerable MailChimp lookup is reachable without logging in. Sites without this plugin, or running 2.0.2 or later, are not affected. The sources do not say whether non-default configuration is required.
No product ranges from the sources yet.
wp plugin list and look for Customer Engagement System below 2.0.22.0.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
This page as .md · .json · in your agent: get_signal("CVE-2026-115225")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.