CVE-2026-92436
Low risk· EPSS 6%Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier derived from a customer's email address. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read that customer's saved cart contents.
Risk Assessment
Disclosure of store customer information and their saved cart contents without authentication. This may violate customer privacy and constitute a data leak.
Recommendation
Update the Mailchimp for WooCommerce plugin to version 6.3 or later. Until then, consider restricting access to the saved cart functionality.
Other vulnerabilities in Mailchimp for WooCommerce
See all- CVE-2026-92435Medium
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
- CVE-2026-73346High
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
Original NVD description (English source)
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS