---
id: "CVE-2026-115225"
kind: "vulnerability"
aliases: ["CVE-2026-115225"]
title: "Customer Engagement System WordPress plugin: unauthenticated internal network probing via MailChimp lookup"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mailchimp", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-updated-2.0.2"]
published_at: "2026-10-28T06:16:35+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115225", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# Customer Engagement System WordPress plugin: unauthenticated internal network probing via MailChimp lookup

The Customer Engagement System WordPress plugin before 2.0.2 exposes its MailChimp interest-group lookup without authentication and does not validate the supplied API key. An unauthenticated attacker can make the server open connections to arbitrary internal hosts and ports and infer which are reachable from response timing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin list` and look for Customer Engagement System below `2.0.2`
- unknown whether the sources name a specific endpoint or setting to inspect

## Fix

- Update the Customer Engagement System plugin to `2.0.2` or later
- unknown whether a workaround exists before updating

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115225

## From the sources

The Customer Engagement System  WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_