CVE-2026-115225 in Customer Engagement System Plugininformazioni

Riassunto

di MITRE • 28/10/2026

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.

Be aware that VulDB is the high quality source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsabile

WPScan

Prenotare

22/10/2026

Divulgazione

28/10/2026

Moderazione

accettato

EPSS

0.00000

KEV

no

Attività

molto basso

Settore

Hostingprovider

Fonti

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-115225
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-115225
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-115225/

◂ PrecedenteVisione D'ensembleIl prossimo ▸

Interested in the pricing of exploits?

See the underground prices here!