{"id":"CVE-2026-118167","kind":"vulnerability","aliases":["CVE-2026-118167"],"related":[],"title":"WordPress MC4WP Mailchimp plugin lets visitors subscribe to any audience","description":"The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.","summary":"The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not check that a sign-up form subscribes visitors to the audience the site owner configured. An unauthenticated visitor can add arbitrary email addresses to any other audience in the site's connected Mailchimp account.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mailchimp","mc4wp","package","wordpress"],"not_affected_if":["no-mailchimp-connection","plugin-4.15.0-or-later"],"how_to_check":"- Check the installed version of the MC4WP: Mailchimp for WordPress plugin in the WordPress admin plugins list; versions below `4.15.0` are in scope.\n- Review which Mailchimp audiences the connected account holds, since any of them could be targeted.","fix":"- MC4WP: Mailchimp for WordPress plugin: `4.15.0` or later.","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:52+00:00","updated_at":"2026-11-06T06:41:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:52Z","model":"claude-haiku-5-5","output":{"fix":"- MC4WP: Mailchimp for WordPress plugin: `4.15.0` or later.","reach":"internet","title":"WordPress MC4WP Mailchimp plugin lets visitors subscribe to any audience","impact":"low","summary":"The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not check that a sign-up form subscribes visitors to the audience the site owner configured. An unauthenticated visitor can add arbitrary email addresses to any other audience in the site's connected Mailchimp account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mailchimp","mc4wp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker adds arbitrary emails to other Mailchimp audiences","analyst_note":"","how_to_check":"- Check the installed version of the MC4WP: Mailchimp for WordPress plugin in the WordPress admin plugins list; versions below `4.15.0` are in scope.\n- Review which Mailchimp audiences the connected account holds, since any of them could be targeted.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-4.15.0-or-later","no-mailchimp-connection"],"who_is_affected":"Sites running the MC4WP: Mailchimp for WordPress plugin before 4.15.0 with a Mailchimp account connected. Exposure is through public sign-up forms, so any site with such a form accepting visitor input is in scope; sites without the plugin or on 4.15.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000723,"input_tokens":4252,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118167':13A,16A '-2026':12A,15A '4.15.0':28B,73C 'account':65B,119C 'add':51B 'address':54B,108C 'allow':101C 'arbitrari':52B,106C 'audienc':10A,42B,58B,80C,95C,112C 'bundl':87C 'check':31B 'configur':46B,96C 'connect':63B,117C 'cve':11A,14A 'email':53B,107C 'form':37B,85C 'integr':88C 'let':5A 'mailchimp':3A,17B,23B,64B,68C,79C,118C 'match':93C 'mc4wp':2A,18B,22B,67C 'owner':45B,100C 'packag':19B 'plugin':4A,26B,71C 'sign':35B,83C 'sign-up':34B,82C 'site':44B,61B,99C,115C 'subscrib':7A,38B,89C,105C 'unauthent':48B,102C 'valid':76C 'visitor':6A,39B,49B,91C,103C 'wordpress':1A,20B,25B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MC4WP: Mailchimp for WordPress plugin before 4.15.0 with a Mailchimp account connected. Exposure is through public sign-up forms, so any site with such a form accepting visitor input is in scope; sites without the plugin or on 4.15.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","mailchimp","mc4wp","package","wordpress"],"campaign_type":null,"search_a":"'-118167':13A,16A '-2026':12A,15A 'audienc':10A 'cve':11A,14A 'let':5A 'mailchimp':3A 'mc4wp':2A 'plugin':4A 'subscrib':7A 'visitor':6A 'wordpress':1A","search_b":"'4.15.0':28B 'account':65B 'add':51B 'address':54B 'arbitrari':52B 'audienc':42B,58B 'check':31B 'configur':46B 'connect':63B 'email':53B 'form':37B 'mailchimp':17B,23B,64B 'mc4wp':18B,22B 'owner':45B 'packag':19B 'plugin':26B 'sign':35B 'sign-up':34B 'site':44B,61B 'subscrib':38B 'unauthent':48B 'visitor':39B,49B 'wordpress':20B,25B","search_c":"'4.15.0':73C 'account':119C 'address':108C 'allow':101C 'arbitrari':106C 'audienc':80C,95C,112C 'bundl':87C 'configur':96C 'connect':117C 'email':107C 'form':85C 'integr':88C 'mailchimp':68C,79C,118C 'match':93C 'mc4wp':67C 'owner':100C 'plugin':71C 'sign':83C 'sign-up':82C 'site':99C,115C 'subscrib':89C,105C 'unauthent':102C 'valid':76C 'visitor':91C,103C 'wordpress':70C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118167","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}