CVE-2023-3779

MediumCVSS 5.3

Published: 20/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

38th percentile - higher than 38% of all known CVEs

Summary

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to and including 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This allows unauthenticated attackers to obtain a site's MailChimp API key.

Risk Assessment

Organizations may be exposed to unauthorized access to the MailChimp API key, potentially leading to unauthorized actions on the MailChimp account. If a vulnerable version of the plugin with the MailChimp block enabled is in use, the API key may have been compromised.

Recommendation

It is recommended to reset any MailChimp API keys if running a vulnerable version of the plugin with the MailChimp block enabled. Additionally, consider updating the plugin to the latest version to eliminate this vulnerability.

Original NVD description (English source)

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.