CVE-2026-118166 · Package
NO FIX YET · SEE WHAT TO DO
The MC4WP Mailchimp for WordPress plugin before 4.15.0 lets request-derived values in dynamic content tags be processed as shortcodes when a form is embedded with its block. An unauthenticated visitor can execute any registered shortcode with attacker-chosen attributes.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MC4WP: Mailchimp for WordPress plugin before 4.15.0 where the site owner added a request-derived dynamic content tag to a form and embedded that form with the block rather than the classic shortcode. Sites that use only the classic shortcode, or forms without request-derived tags, are not described as exposed.
Not affected if classic-shortcode-only, no-request-derived-tags, version-4.15.0-or-later
Who cares mailchimp-for-wordpress, mc4wp, wordpress
4.15.0.4.15.0 or later.The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.