rootpwn

medium · CVSS v3 5.3 · EPSS 0.00136

CVE-2026-92435

The Mailchimp for WooCommerce WordPress plugin before version 6.1.1 fails to properly verify user capabilities within the permission callbac

Overview

The Mailchimp for WooCommerce WordPress plugin before version 6.1.1 fails to properly verify user capabilities within the permission callbacks for multiple REST API routes. This oversight allows unauthenticated attackers to access administrator-oriented endpoints and make persistent state changes.

Description

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

Impact

This vulnerability impacts confidentiality and integrity by exposing administrative endpoints to unauthenticated users, potentially allowing unauthorized state modifications. Website administrators and site owners face a moderate risk of unauthorized configuration changes or data exposure within the affected WordPress environment.

Remediation

Update the Mailchimp for WooCommerce plugin to version 6.1.1 or later where the missing permission callback checks have been resolved. Regularly audit WordPress REST API access logs for unusual requests directed at plugin-specific endpoints, and enforce the principle of least privilege across all user roles.

Risk context

This vulnerability is rated as medium severity with a CVSS score of 5.3 and a low EPSS score of 0.00136. While it requires no authentication, remediation can be achieved promptly by applying the vendor-supplied plugin update.

Affected products

  • Mailchimp for WooCommerce WordPress plugin

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
0.00136

wordpress plugin rest-api missing-authorization unauthenticated mailchimp

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis