CVE-2026-27356 · Package
NO FIX YET · SEE WHAT TO DO
The MC4WP (Mailchimp for WP) WordPress plugin has a missing authorization check, so access control settings can be bypassed. An attacker may be able to reach functions they should not be allowed to use.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MC4WP (Mailchimp for WP) WordPress plugin at version 4.14.1 or earlier. The sources do not describe which settings or roles make a site exposed, so the access control configuration of the site is the thing to review.
Not affected if plugin-not-installed
Who cares mailchimp-for-wp, mc4wp, wordpress
wp-content/plugins/mailchimp-for-wp/ for the plugin header.4.14.1 or earlier.4.14.1; the exact fixed version is unknown from the sources.Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.