CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Customer Email and Cart Disclosure vulnerability

Unauthenticated Customer Email and Cart Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin MailChimp For WooCommerce versions 6.3...

CVE-2026-92436

The Mailchimp for WooCommerce WordPress plugin (versions before 6.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to require authentication or verify ownership when loading a saved cart from a request-supplied identifier derived from a customer's email addr...