CVE-2026-7520: MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin() and signup() AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/MailChimp Forms by MailMunchto a version that resolves this vulnerability.Fixed in 3.2.7 - Compensating control
Assume the MailMunch integration was potentially relinked by an authenticated attacker; verify and re-establish the MailMunch integration on the site using only trusted MailMunch credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7520?
The severity of CVE-2026-7520 is rated as high with a score of 8.1.
How do I fix CVE-2026-7520?
To fix CVE-2026-7520, update the MailChimp Forms by MailMunch plugin to version 3.2.8 or later.
What is the impact of CVE-2026-7520?
CVE-2026-7520 allows authenticated attackers to modify data due to a lack of capability checks in the plugin's AJAX handlers.
Which versions are affected by CVE-2026-7520?
CVE-2026-7520 affects all versions of the MailChimp Forms by MailMunch plugin up to and including 3.2.7.
Is user authentication enough to prevent CVE-2026-7520 exploitation?
No, CVE-2026-7520 allows exploitation even for authenticated users categorized as Subscriber+, as it lacks proper authorization checks.