CVE-2026-27356: WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability
Published Nov 6, 2026
·Updated
Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MC4WP mailchimp-for-wpto a version that resolves this vulnerability.Fixed in 4.15.0
Event History
Nov 6, 2026
CVE Published
via MITRE·10:31 PM
Data Sourced
via MITRE·10:31 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is a fixed version identified in the available advisory data?
No fixed version is identified. The reported affected range extends through version 4.14.1.
2
Does the available information specify which user roles, permissions, or configurations enable exploitation?
No. It identifies incorrectly configured access-control security levels as the issue area, but does not provide the affected roles, required privileges, or triggering configuration.