CVE-2026-118167 MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...

CVE-2026-118167

The MC4WP: Mailchimp for WordPress plugin (versions before 4.15.0 ) is vulnerable to an unauthenticated subscription audience override due to insufficient validation. The plugin fails to verify that the Mailchimp audience associated with a sign-up form or bundled integration matches the specific ...