CVE-2026-118167 · Package
NO FIX YET · SEE WHAT TO DO
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not check that a sign-up form subscribes visitors to the audience the site owner configured. An unauthenticated visitor can add arbitrary email addresses to any other audience in the site's connected Mailchimp account.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MC4WP: Mailchimp for WordPress plugin before 4.15.0 with a Mailchimp account connected. Exposure is through public sign-up forms, so any site with such a form accepting visitor input is in scope; sites without the plugin or on 4.15.0 or later are not affected.
Not affected if no-mailchimp-connection, plugin-4.15.0-or-later
Who cares mailchimp, mc4wp, wordpress
4.15.0 are in scope.4.15.0 or later.The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.