CVE-2026-1781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1781", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-02T20:27:48.205Z", "datePublished": "2026-03-11T01:22:03.740Z", "dateUpdated": "2026-04-08T16:35:55.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:55.094Z"}, "affected": [{"vendor": "dvankooten", "product": "MC4WP: Mailchimp for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source)."}], "title": "MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form.php#L461"}, {"url": "https://cwe.mitre.org/data/definitions/862.html"}, {"url": "https://github.com/ibericode/mailchimp-for-wordpress/commit/5fdebc2a5e22d11287d011697a6b09331bd96fa5"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3477825%40mailchimp-for-wp%2Ftrunk&old=3443118%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "timeline": [{"time": "2026-02-03T12:30:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T13:11:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:49:58.367011Z", "id": "CVE-2026-1781", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:50:08.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:49:58.367011Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:50:05.885Z"}}], "cna": {"title": "MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "dvankooten", "product": "MC4WP: Mailchimp for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.11.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T12:30:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T13:11:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form.php#L461"}, {"url": "https://cwe.mitre.org/data/definitions/862.html"}, {"url": "https://github.com/ibericode/mailchimp-for-wordpress/commit/5fdebc2a5e22d11287d011697a6b09331bd96fa5"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3477825%40mailchimp-for-wp%2Ftrunk&old=3443118%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:55.094Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1781", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:55.094Z", "dateReserved": "2026-02-02T20:27:48.205Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T01:22:03.740Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MC4WP: Mailchimp for WordPress", "vendor": "dvankooten", "versions": [{"lessThanOrEqual": "4.11.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source)."}, {"lang": "es", "value": "El plugin de WordPress MC4WP: Mailchimp for WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 4.11.1, inclusive. Esto se debe a que el plugin conf\u00eda en el par\u00e1metro POST '_mc4wp_action' sin validaci\u00f3n, lo que permite a atacantes no autenticados forzar al formulario a procesar acciones de desuscripci\u00f3n en lugar de acciones de suscripci\u00f3n. Esto hace posible que atacantes no autenticados desuscriban arbitrariamente cualquier direcci\u00f3n de correo electr\u00f3nico de la audiencia de Mailchimp conectada a trav\u00e9s del par\u00e1metro '_mc4wp_action', siempre que puedan obtener el ID del formulario (que est\u00e1 expuesto p\u00fablicamente en el c\u00f3digo fuente HTML)."}], "id": "CVE-2026-1781", "lastModified": "2026-06-17T10:16:30.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1781", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:49:58.367011Z", "version": "2.0.3"}}]}, "published": "2026-03-11T02:16:03.493", "references": [{"source": "security@wordfence.com", "url": "https://cwe.mitre.org/data/definitions/862.html"}, {"source": "security@wordfence.com", "url": "https://github.com/ibericode/mailchimp-for-wordpress/commit/5fdebc2a5e22d11287d011697a6b09331bd96fa5"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L207"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form-listener.php#L53"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mailchimp-for-wp/tags/4.11.1/includes/forms/class-form.php#L461"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3477825%40mailchimp-for-wp%2Ftrunk&old=3443118%40mailchimp-for-wp%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MC4WP: Mailchimp for WordPress", "source": "cna", "vendor": "dvankooten"}, "product": "mc4wp:_mailchimp_for_wordpress", "vendor": "dvankooten"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T15:00:23.780112+00:00", "value": {"mitigation_remediation": ["Update MC4WP: Mailchimp for WordPress to a version newer than 4.11.1"], "summary": {"action": "Patch", "impact": "Unauthorized Unsubscription"}, "threat_synthesis": {"affected_systems": "All installations of the MC4WP: Mailchimp for WordPress plugin up to, and including, version 4.11.1 are affected. The vulnerability is triggered via a publicly exposed form ID, which is displayed in the page\u2019s HTML source. The plugin is developed by dvankooten:MC4WP: Mailchimp for WordPress and is used in WordPress sites that integrate with Mailchimp audiences.", "description_and_impact": "The CVE reveals that the MC4WP: Mailchimp for WordPress plugin accepts an unvalidated POST parameter named _mc4wp_action. This flaw allows an unauthenticated user to trigger an unsubscribe operation instead of the intended subscribe action. The effect is that an attacker can remove any email address from the configured Mailchimp audience, compromising the integrity of the marketing list. The weakness is identified as CWE-862 (Missing Authorization) and manifests as a moderate severity vulnerability with a CVSS score of 6.5.", "risk_and_exploitability": "The risk level is moderate (CVSS 6.5) with an exploit probability of less than 1% as indicated by EPSS. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a simple HTTP POST request to the form endpoint with the _mc4wp_action parameter set to trigger an unsubscribe, provided they know the public form ID. No authentication is required, making the attack straightforward for any user on the internet."}}}}, "created": "2026-03-11T11:38:25.451796+00:00", "updated": "2026-03-20T14:38:23.771309+00:00", "vendors": ["dvankooten", "dvankooten$PRODUCT$mc4wp:_mailchimp_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}