CVE-2026-8151: Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simple Membership MailChimp Integration WordPress pluginto a version that resolves this vulnerability.Fixed in 1.9.8 - Operational
After replacing the Simple Membership MailChimp Integration WordPress plugin, verify that the configured third-party MailChimp API key and destination account settings were not changed by an attacker; if exposure is suspected, rotate/update the MailChimp API key and reconfigure the plugin accordingly.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Simple Membership MailChimp Integration WordPress plugin at a version before 1.9.8 are exposed if a logged-in administrator can be induced to submit the forged settings request.
What does an attacker need to exploit it?
The attacker does not need prior authentication, but must trick a logged-in WordPress administrator into interacting with a malicious request. The attack relies on the settings page lacking CSRF protections.
What happens after successful exploitation?
The configured third-party API key can be replaced with an attacker-controlled key. Subsequent member registrations may then send names, email addresses, and membership levels to the attacker-controlled account.
How can administrators tell whether they may already be affected?
Review the plugin's configured third-party API key and confirm it belongs to the intended account. Also review member-registration data destinations for unexpected accounts or API-key changes.