What is the CVSS score of CVE-2026-15000?

CVE-2026-15000 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of CF7 Mailchimp Extension are affected by CVE-2026-15000?

The Connect Contact Form 7 and Mailchimp WordPress plugin through version 0.9.78.06 contains a stored cross-site scripting vulnerability that allows unauthenticated form submissions to plant…

How to fix or mitigate CVE-2026-15000?

24 hours: Inventory all WordPress deployments running Connect Contact Form 7 and Mailchimp plugin versions ≤0.9.78.06 and assess business criticality. 7 days: Either disable the plugin or restrict Contact Lookup access to a minimal set of trusted administrators; enable multi-factor authentication on admin accounts. 30 days: Contact plugin vendor for confirmed patch availability and timeline; evaluate alternative form-handling solutions or plan upgrade upon patch release.

CF7 Mailchimp Extension CVE-2026-15000

EUVD-2026-42523 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-6h77-cm5j-f2x9

WordPress XSS Wordpress Plugin Connect Contact Form 7 And Mailchimp

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated injection (PR:N) over the network (AV:N), but execution requires an administrator to perform a Contact Lookup, so UI:R; XSS runs in the separate admin context (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:32 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

HIGH 7.2

DescriptionCVE.org

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is only triggered when a privileged user (Administrator) performs a Contact Lookup for the email address submitted via the CF7 form, meaning execution is deferred until an administrator interacts with the affected entry.

AnalysisAI

Stored cross-site scripting in the Connect Contact Form 7 and Mailchimp WordPress plugin (all versions through 0.9.78.06) lets unauthenticated visitors plant JavaScript through Mailchimp merge-field values submitted via a Contact Form 7 form. The payload lies dormant until an Administrator runs a Contact Lookup on the submitted email address, at which point the script executes in the privileged admin session. Reported by Wordfence with a CVSS of 7.2; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:rnzo:connect_contact_form_7_and_mailchimp) that bridges Contact Form 7 submissions into Mailchimp by mapping form fields to Mailchimp merge variables. The root cause is CWE-79 (improper neutralization of input during web page generation): the merge-variable builder (class-cmatic-merge-vars-builder.php) accepts attacker-supplied field values and the Contact Lookup path (class-cmatic-contact-lookup.php) and front-end script (chimpmatic-lite.js) later render those stored values into the admin-facing UI without sufficient sanitization on input or escaping on output. Because the data is persisted and rendered in a different security context (the WordPress admin) than where it was injected, this is a second-order/stored XSS rather than a reflected one.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3599649%40contact-form-7-mailchimp-extension&new=3599649%40contact-form-7-mailchimp-extension shows corrective changes, but no fixed release number above 0.9.78.06 is stated in the provided data, so update to the latest available plugin release once published and confirm the version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/be2579e3-8e40-4603-9ec1-38f43dc1aa29?source=cve). Until a patched release is confirmed, reduce exposure by having administrators avoid using the Contact Lookup feature on untrusted submissions and instead review raw entries in a context that does not render HTML, restricting the plugin's admin pages via a WAF rule (Wordfence virtual patching) that filters script content in merge-field/lookup responses; the trade-off is that disabling Contact Lookup removes the plugin's admin convenience workflow and WAF filtering may need tuning to avoid breaking legitimate names containing angle brackets or quotes. Do not treat any invented version number as authoritative.