{"id":"CVE-2026-115225","kind":"vulnerability","aliases":["CVE-2026-115225"],"related":[],"title":"Customer Engagement System WordPress plugin: unauthenticated internal network probing via MailChimp lookup","description":"The Customer Engagement System  WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.","summary":"The Customer Engagement System WordPress plugin before 2.0.2 exposes its MailChimp interest-group lookup without authentication and does not validate the supplied API key. An unauthenticated attacker can make the server open connections to arbitrary internal hosts and ports and infer which are reachable from response timing.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mailchimp","package","self-hosted","wordpress"],"not_affected_if":["plugin-updated-2.0.2"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin list` and look for Customer Engagement System below `2.0.2`\n- unknown whether the sources name a specific endpoint or setting to inspect","fix":"- Update the Customer Engagement System plugin to `2.0.2` or later\n- unknown whether a workaround exists before updating","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:25+00:00","updated_at":"2026-10-28T06:32:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Customer Engagement System plugin to `2.0.2` or later\n- unknown whether a workaround exists before updating","reach":"internet","title":"Customer Engagement System WordPress plugin: unauthenticated internal network probing via MailChimp lookup","impact":"low","summary":"The Customer Engagement System WordPress plugin before 2.0.2 exposes its MailChimp interest-group lookup without authentication and does not validate the supplied API key. An unauthenticated attacker can make the server open connections to arbitrary internal hosts and ports and infer which are reachable from response timing.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","mailchimp"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker maps internal hosts and ports from the server","analyst_note":"Confirm the affected plugin version range and whether the lookup endpoint is active by default, using the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin list` and look for Customer Engagement System below `2.0.2`\n- unknown whether the sources name a specific endpoint or setting to inspect","needs_analyst":true,"not_affected_if":["plugin-updated-2.0.2"],"who_is_affected":"Sites running the Customer Engagement System WordPress plugin before version 2.0.2 are exposed, since the vulnerable MailChimp lookup is reachable without logging in. Sites without this plugin, or running 2.0.2 or later, are not affected. The sources do not say whether non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3313,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115225':15A,18A '-2026':14A,17A '2.0.2':32B,80C 'access':84C 'allow':100C 'api':48B,95C 'arbitrari':60B,110C 'attack':52B 'authent':41B 'connect':58B,108C 'custom':1A,26B,74C 'cve':13A,16A 'engag':2A,27B,75C 'expos':33B 'group':38B,90C 'host':23B,62B,112C 'infer':66B,116C 'interest':37B,89C 'interest-group':36B,88C 'intern':7A,61B,111C 'key':49B,96C 'lookup':12A,39B,91C 'mailchimp':11A,19B,35B,87C 'make':54B,104C 'network':8A 'one':121C 'open':57B,107C 'packag':20B 'plugin':5A,30B,78C 'port':64B,114C 'probe':9A 'reachabl':69B,123C 'respons':71B,118C 'restrict':83C 'self':22B 'self-host':21B 'server':56B,106C 'suppli':47B,97C 'system':3A,28B,76C 'time':72B,119C 'unauthent':6A,51B,101C 'user':102C 'valid':45B,93C 'via':10A 'without':40B 'wordpress':4A,24B,29B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Customer Engagement System WordPress plugin before version 2.0.2 are exposed, since the vulnerable MailChimp lookup is reachable without logging in. Sites without this plugin, or running 2.0.2 or later, are not affected. The sources do not say whether non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115225","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}