CVE-2026-118167: MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

Q: Who is exposed to this issue?

Sites using MC4WP: Mailchimp for WordPress versions earlier than 4.15.0 that have a connected Mailchimp account are exposed. The issue affects sign-up forms and bundled integrations that can be manipulated to select a different audience in that connected account.

Q: What does an attacker need to exploit it?

The attacker does not need to authenticate. They need to be able to submit a vulnerable sign-up form or bundled integration and can subscribe arbitrary email addresses to other audiences in the site's connected Mailchimp account.

Q: How can I tell whether my site is affected?

Check whether the installed MC4WP: Mailchimp for WordPress version is earlier than 4.15.0 and whether it is connected to a Mailchimp account. Sites meeting both conditions should treat their subscription forms and bundled integrations as potentially affected.

Published Nov 6, 2026

Updated

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MC4WP: Mailchimp for WordPress to a version that resolves this vulnerability.
Fixed in 4.15.0

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using MC4WP: Mailchimp for WordPress versions earlier than 4.15.0 that have a connected Mailchimp account are exposed. The issue affects sign-up forms and bundled integrations that can be manipulated to select a different audience in that connected account.

What does an attacker need to exploit it?

The attacker does not need to authenticate. They need to be able to submit a vulnerable sign-up form or bundled integration and can subscribe arbitrary email addresses to other audiences in the site's connected Mailchimp account.

How can I tell whether my site is affected?

Check whether the installed MC4WP: Mailchimp for WordPress version is earlier than 4.15.0 and whether it is connected to a Mailchimp account. Sites meeting both conditions should treat their subscription forms and bundled integrations as potentially affected.

CVE-2026-118167: MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my site is affected?