CVE-2026-118167 in MC4WP Mailchimp Plugin
Summary
by MITRE • 11/06/2026
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in MC4WP: Mailchimp for WordPress prior to version 4.15.0 represents a critical failure in input validation and authorization logic within the plugin’s subscription handling mechanisms. This flaw allows unauthenticated users, or any visitor with access to the public-facing website, to manipulate the parameters sent during the sign-up process. Specifically, the application fails to verify that the Mailchimp audience identifier provided by the client-side form matches the specific audience ID configured and authorized by the site administrator for that particular integration point. This lack of server-side validation creates a direct path for attackers to bypass intended access controls, effectively treating all audiences within the connected Mailchimp account as accessible targets regardless of their designated purpose or privacy settings.
From a technical perspective, this issue stems from an insecure direct object reference pattern where the application trusts client-supplied data without sufficient verification against server-side configuration states. When a user submits a subscription form, the plugin accepts the audience ID parameter and forwards it to the Mailchimp API endpoint for list management. Because there is no intermediate check to ensure that the requested audience ID corresponds to one of the audiences explicitly whitelisted or configured by the site owner in the WordPress admin dashboard, the system processes the request as valid if the audience exists within the broader account structure. This architectural oversight means that an attacker can simply modify the form data via browser developer tools or custom scripts to specify a different audience ID belonging to another list managed under the same Mailchimp API key credentials associated with the compromised site.
The operational impact of this vulnerability is significant, particularly regarding privacy compliance and brand reputation. By subscribing arbitrary email addresses to unintended audiences, attackers can cause substantial deliverability issues for legitimate marketing campaigns sent to those specific lists. Furthermore, this action violates core principles of data protection regulations such as GDPR or CCPA, as it results in the processing of personal data without proper consent from the individuals involved. The victims are not only the site administrators who lose control over their subscriber segmentation but also the end-users whose email addresses are added to mailing lists they never opted into, potentially leading to spam complaints and damage to the trust relationship between the website owner and its audience.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting the failure to enforce proper authorization checks on user inputs. In terms of offensive security frameworks, it maps closely to MITRE ATT&CK technique T1505.003, known as Web Services: Cloud Accounts, where an attacker leverages compromised credentials or misconfigured services to interact with external cloud-based resources. The exploitation vector is classified under CWE-20, Improper Input Validation, because the root cause lies in the acceptance of untrusted data without rigorous sanitization and context-aware validation against expected configuration parameters.
Mitigation strategies must focus on immediate patching and enhanced input handling practices. Site administrators should upgrade MC4WP to version 4.15.0 or later immediately, as this release includes patches that enforce strict audience ID verification during the subscription process. For environments where upgrading is not instantly feasible, temporary mitigations include restricting API key permissions in Mailchimp to limit access only to necessary audiences and implementing additional server-side validation logic if custom code modifications are possible. Additionally, enabling CAPTCHA on all public-facing forms can help mitigate automated exploitation attempts by adding a layer of friction that distinguishes human users from scripted attacks, although this does not resolve the underlying authorization flaw. Regular security audits of third-party plugin configurations are essential to prevent similar misconfigurations in future integrations with external services.