Customer Engagement System CVE-2026-115225

Exploitation requires only that the plugin (Customer Engagement System before 2.0.2) is installed and its MailChimp interest-group lookup interface is reachable; the description states this interface does not restrict access and does not validate the supplied API key, so no authentication, user interaction, or non-default configuration is needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is the nature of the impact: this is a blind SSRF that only lets the attacker infer host/port reachability from response timing, not retrieve response bodies or reach systems the WordPress server itself cannot route to, so real-world value depends on what internal network the host can connect to.

This is a moderate-severity SSRF (CWE-918) with a coherent set of low-urgency signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, unauthenticated, low-complexity access, and the Scope change (S:C) reflects that the vulnerable WordPress host is coerced into connecting to other internal systems; impact is limited to C:L with no integrity or availability effect, consistent with a blind/timing-based reachability oracle rather than data theft or code execution. EPSS is low at 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit is identified, so all three real-world-exploitation signals agree this is not under active or imminent mass exploitation. The vuln.today decision label is 'this_month,' which matches a patch-available, genuine-but-not-emergency SSRF. The main value of this flaw to an attacker is internal network reconnaissance (port/host reachability mapping) from the perimeter, not direct compromise; its real priority is driven more by how exposed the host is and what internal services it can reach than by the base score. No key signals conflict here.

An unauthenticated attacker sends crafted requests to the plugin's unprotected MailChimp interest-group lookup endpoint, supplying attacker-chosen internal hostnames/ports so the WordPress server opens outbound connections on their behalf. By comparing response timing, the attacker infers which internal hosts and ports are reachable, building a map of the internal network from outside. No public exploit code is identified at time of analysis.