CVE-2026-115225 Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

CVE-2026-115225

The Customer Engagement System WordPress plugin versions before 2.0.2 is vulnerable to an unauthenticated SSRF (Server-Side Request Forgery) via the MailChimp interest-group lookup. The root cause is the failure to restrict access to this lookup and a lack of validation for the supplied API key. ...