Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the...

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

CVE-2026-109515

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

EUVD-2026-102644

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

CVE-2026-109515: Improper Privilege Management

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

PT-2026-115432

Name of the Vulnerable Software and Affected Versions MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. versions prior to 1.2.78.7 Description An unauthenticated privilege escalation issue exists because the subscribe to email list endpoint accepts an...

CVE-2026-92437

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

EUVD-2026-91945

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-92437 Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

CVE-2026-92437

The Mailchimp for WooCommerce WordPress plugin, in versions prior to 6.3 , is vulnerable to unauthorized data modification. The application fails to implement authentication , nonce , or ownership checks when processing customer abandoned-cart records identified via request-supplied data. This fl...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion vulnerability

Unauthenticated Abandoned Cart Modification and Deletion vulnerability discovered by Mutantgun in WordPress Plugin MailChimp For WooCommerce versions 6.3...

CVE-2026-92437: Missing Authorization

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored...

PT-2026-104531

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 Description An issue exists where the plugin fails to require authentication, a nonce a unique token used to prevent replay attacks, or an ownership check before processing actio...

CVE-2026-92436

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

CVE-2026-92436

The Mailchimp for WooCommerce WordPress plugin (versions before 6.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to require authentication or verify ownership when loading a saved cart from a request-supplied identifier derived from a customer's email addr...

CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Customer Email and Cart Disclosure vulnerability

Unauthenticated Customer Email and Cart Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin MailChimp For WooCommerce versions 6.3...

EUVD-2026-87896

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...