CVE-2026-92435
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Risk Assessment
Unauthenticated users can modify plugin settings or data, potentially leading to integrity compromise of the store and further attacks.
Recommendation
Update the Mailchimp for WooCommerce plugin to version 6.1.1 or later. Additionally, ensure all REST API routes have proper permission checks.
Other vulnerabilities in Mailchimp for WooCommerce
See all- CVE-2026-92436Low risk· EPSS 6%
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier derived from a customer's email address. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read that customer's saved cart contents.
- CVE-2026-73346High
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
Original NVD description (English source)
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS