Mailchimp for WooCommerce vulnerabilities

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier derived from a customer's email address. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read that customer's saved cart contents.

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.