{"id":"CVE-2026-27356","kind":"vulnerability","aliases":["CVE-2026-27356"],"related":[],"title":"MC4WP Mailchimp for WP: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.","summary":"The MC4WP (Mailchimp for WP) WordPress plugin has a missing authorization check, so access control settings can be bypassed. An attacker may be able to reach functions they should not be allowed to use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mailchimp-for-wp","mc4wp","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/mailchimp-for-wp/` for the plugin header.\n- Confirm whether the installed version is `4.14.1` or earlier.","fix":"- Move MC4WP to a version later than `4.14.1`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-06T23:17:22+00:00","first_seen_at":"2026-11-06T23:44:35+00:00","triaged_at":"2026-11-06T23:45:12+00:00","updated_at":"2026-11-06T23:45:12+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T23:45:12Z","model":"claude-haiku-5-5","output":{"fix":"- Move MC4WP to a version later than `4.14.1`; the exact fixed version is unknown from the sources.","reach":"internet","title":"MC4WP Mailchimp for WP: missing authorization lets users bypass access controls","impact":"medium","summary":"The MC4WP (Mailchimp for WP) WordPress plugin has a missing authorization check, so access control settings can be bypassed. An attacker may be able to reach functions they should not be allowed to use.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mc4wp","mailchimp-for-wp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/mailchimp-for-wp/` for the plugin header.\n- Confirm whether the installed version is `4.14.1` or earlier.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MC4WP (Mailchimp for WP) WordPress plugin at version 4.14.1 or earlier. The sources do not describe which settings or roles make a site exposed, so the access control configuration of the site is the thing to review.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4218,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-27356':14A,17A '4.14.1':83C 'abl':48B 'access':10A,38B,73C 'affect':78C 'allow':56B,69C 'attack':45B 'author':6A,35B,60C 'bypass':9A,43B 'check':36B 'configur':72C 'control':11A,39B,74C 'cve':12A,15A 'exploit':70C 'function':51B 'ibericod':63C 'incorrect':71C 'issu':77C 'let':7A 'levels.this':76C 'mailchimp':2A,19B,27B,66C 'mailchimp-for-wp':18B,65C 'may':46B 'mc4wp':1A,22B,26B,64C,79C 'miss':5A,34B,59C 'n/a':81C 'packag':23B 'plugin':31B 'reach':50B 'secur':75C 'set':40B 'use':58B 'user':8A 'vulner':61C 'wordpress':24B,30B 'wp':4A,21B,29B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MC4WP (Mailchimp for WP) WordPress plugin at version 4.14.1 or earlier. The sources do not describe which settings or roles make a site exposed, so the access control configuration of the site is the thing to review.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mailchimpforwp","mc4wp","medium","package","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-27356':14A,17A 'access':10A 'author':6A 'bypass':9A 'control':11A 'cve':12A,15A 'let':7A 'mailchimp':2A 'mc4wp':1A 'miss':5A 'user':8A 'wp':4A","search_b":"'abl':48B 'access':38B 'allow':56B 'attack':45B 'author':35B 'bypass':43B 'check':36B 'control':39B 'function':51B 'mailchimp':19B,27B 'mailchimp-for-wp':18B 'may':46B 'mc4wp':22B,26B 'miss':34B 'packag':23B 'plugin':31B 'reach':50B 'set':40B 'use':58B 'wordpress':24B,30B 'wp':21B,29B","search_c":"'4.14.1':83C 'access':73C 'affect':78C 'allow':69C 'author':60C 'configur':72C 'control':74C 'exploit':70C 'ibericod':63C 'incorrect':71C 'issu':77C 'levels.this':76C 'mailchimp':66C 'mailchimp-for-wp':65C 'mc4wp':64C,79C 'miss':59C 'n/a':81C 'secur':75C 'vulner':61C 'wp':68C","first_public_at":"2026-11-06T23:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-27356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27356","severity":null,"published_at":"2026-11-06T23:17:22+00:00","modified_at":"2026-11-06T23:17:22+00:00","first_seen_at":"2026-11-06T23:44:35+00:00","fetched_at":"2026-11-06T23:44:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}