Mailchimp for WooCommerce
by WordPress
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-73346 | Hig | 0.49 | 7.6 | 0.00 | Aug 13, 2026 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | ||
| CVE-2026-92437 | Med | 0.34 | 5.3 | 0.00 | Oct 3, 2026 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another… | ||
| CVE-2026-92436 | Med | 0.34 | 5.3 | 0.00 | Sep 27, 2026 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a… | ||
| CVE-2026-92435 | Med | 0.34 | 5.3 | 0.00 | Sep 19, 2026 | The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger… | ||
| CVE-2022-2267 | Med | 0.28 | 4.3 | 0.01 | Aug 29, 2022 | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can… | ||
| CVE-2022-2556 | Low | 0.18 | 2.7 | 0.01 | Aug 29, 2022 | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan… |
- risk 0.49cvss 7.6epss 0.00
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
- risk 0.34cvss 5.3epss 0.00
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another…
- risk 0.34cvss 5.3epss 0.00
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a…
- risk 0.34cvss 5.3epss 0.00
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger…
- risk 0.28cvss 4.3epss 0.01
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can…
- risk 0.18cvss 2.7epss 0.01
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan…