CVE-2026-118167 MC4WP CVE debrief

Who should care

Site owners and administrators of WordPress installations using the MC4WP: Mailchimp for WordPress plugin should assess their exposure and consider upgrading to version 4.15.0 or later.

Why it matters

The MC4WP: Mailchimp for WordPress plugin vulnerability allows unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account, requiring site owners and administrators to verify their plugin version and consider upgrading to version 4.15.0 or later.

• Unauthenticated visitors can subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
• Site owners and administrators need to verify their plugin version and consider upgrading to version 4.15.0 or later.
• Mailchimp audience configurations need to be reviewed to ensure they match the site owner's settings.

Technical summary

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate Mailchimp audience configurations, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account. This vulnerability requires site owners and administrators to verify their plugin version and consider upgrading to version 4.15.0 or later to address this issue. The vulnerability has a CVSS score of 5.3 and is considered medium severity. Defenders should review Mailchimp audience configurations to ensure they match the site owner's settings.

Defensive priority

Site owners and administrators of WordPress installations using the MC4WP: Mailchimp for WordPress plugin should verify their plugin version and consider upgrading to version 4.15.0 or later to address this vulnerability.

Recommended defensive actions

• Verify the MC4WP: Mailchimp for WordPress plugin version and upgrade to 4.15.0 or later if necessary.
• Review Mailchimp audience configurations to ensure they match the site owner's settings.
• Monitor for unauthorized subscriptions to Mailchimp audiences.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. The vulnerability allows unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account. Site owners and administrators should verify their plugin version and consider upgrading to version 4.15.0 or later. Evidence is limited to public sources and may not be comprehensive. Defenders should verify plugin versions and review Mailchimp audience configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.