CVE-2026-118166 in MC4WP Mailchimp Plugin
Summary
by MITRE • 11/06/2026
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in MC4WP: Mailchimp for WordPress versions prior to 4.15.0 represents a significant security flaw rooted in improper input validation and processing logic within the plugin's dynamic content handling mechanisms. This issue specifically affects sites that utilize the Gutenberg block editor to embed contact forms, as opposed to those using the legacy shortcode method. The core technical failure lies in how the plugin processes request-derived values embedded within its dynamic content tags. When a form is submitted or interacted with via the block interface, user-supplied input from HTTP requests is injected into these dynamic fields without adequate sanitization before being passed through WordPress's shortcode parser. This architectural oversight allows an attacker to inject maliciously crafted shortcodes that are then executed by the server-side PHP environment rather than being treated as plain text or safe HTML content.
From a technical perspective, this vulnerability constitutes an instance of Unrestricted Shortcode Execution, which aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) and CWE-94 Improper Control of Generation of Code (Code Injection). The attacker leverages the fact that WordPress allows registered plugins to define custom shortcodes. By embedding a dynamic tag within the form block, the site owner inadvertently creates a vector for code injection if they do not restrict which data sources can populate these tags or how those values are processed. When an unauthenticated visitor submits a form containing specially crafted input in fields mapped to these dynamic tags, the plugin fails to escape or neutralize shortcode syntax characters such as square brackets and equals signs. Consequently, the WordPress core interprets this injected content as a command to execute a registered shortcode with attributes chosen by the attacker.
The operational impact of this vulnerability is severe due to its unauthenticated nature and broad potential for exploitation. An external threat actor can exploit this flaw without requiring any valid credentials or prior authentication on the target website. The ability to execute arbitrary registered shortcodes means that if the WordPress installation has other plugins with vulnerable shortcodes, an attacker could potentially achieve Remote Code Execution (RCE), escalate privileges by triggering administrative functions via admin-ajax.php endpoints exposed through shortcodes, or extract sensitive data from the database depending on what capabilities those specific shortcodes possess. Even in scenarios where no directly exploitable shortcodes are present for RCE, this flaw can be used to perform Cross-Site Scripting (XSS) if a shortcode outputs user-controlled content without proper escaping, leading to session hijacking or defacement of the website interface. This aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers execution via various scripting languages available in web environments.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary and most effective solution is to upgrade the MC4WP: Mailchimp for WordPress plugin to version 4.15.0 or later, where this input validation flaw has been patched by ensuring that dynamic content values are properly escaped before being processed as shortcodes. For sites unable to update immediately due to compatibility constraints, administrators should consider disabling the Gutenberg block embedding feature in favor of classic shortcodes if possible, although this is a workaround rather than a fix since the vulnerability specifically targets the block implementation logic. Additionally, implementing strict Content Security Policy (CSP) headers can help mitigate some downstream effects by restricting script execution sources. Regular security audits focusing on how third-party plugins handle user input and integrate with WordPress core functions are essential to prevent similar injection vulnerabilities in future updates or other plugin ecosystems.