What is the CVSS score of CVE-2026-23693?

CVE-2026-23693 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-23693?

A critical, unauthenticated vulnerability in the ElementsKit WordPress plugin allows attackers to abuse Mailchimp API integrations without valid credentials, potentially compromising email marketing…

How to fix or mitigate CVE-2026-23693?

Within 24 hours: Identify all WordPress instances running elementskit-lite below version 3.7.9 and disable the plugin or restrict REST API access. Within 7 days: Contact affected stakeholders and implement WAF rules blocking POST requests to /wp-json/elementskit/v1/widget/mailchimp/subscribe. Within 30 days: Upgrade to version 3.7.9 or later once available, audit Mailchimp API logs for unauthorized activity, and reset exposed API credentials.

WordPress CVE-2026-23693

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-23 disclosure@vulncheck.com

WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 21:19 nvd

CRITICAL 10.0

DescriptionCVE.org

ElementsKit Elementor Addons - Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.

AnalysisAI

Critical vulnerability in ElementsKit Elementor Addons WordPress plugin allows unauthenticated access to critical functions. CVSS 10.0 affecting a widely-used WordPress plugin with 1M+ installations.

Technical ContextAI

CWE-306 missing authentication for critical function in elementskit-lite. The plugin exposes sensitive operations without authentication.

Affected ProductsAI

ElementsKit Elementor Addons (elementskit-lite)

RemediationAI

Update ElementsKit immediately. Audit WordPress sites for unauthorized modifications.

More in WordPress

View all

CVE-2016-10045 CRITICAL Act Now POC

9.8 Dec 30

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-8353 CRITICAL Act Now POC

9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2020-36847 CRITICAL Act Now POC

9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-11749 CRITICAL Emergency POC

9.8 Nov 05

The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-3495 CRITICAL Emergency POC

9.8 May 22

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete

Same weakness CWE-306 – Missing Authentication for Critical Function

View all

CVE-2017-10271 HIGH POC

7.5

CVE-2025-3248 CRITICAL POC

9.8

CVE-2024-11680 CRITICAL POC

9.8

CVE-2025-0108 HIGH POC

8.8

CVE-2025-32433 CRITICAL POC

10.0

CVE-2016-2004 CRITICAL POC

9.8

CVE-2024-46506 CRITICAL POC

10.0

CVE-2025-8943 CRITICAL POC

9.8

CVE-2026-23693 vulnerability details – vuln.today

Back

WordPress CVE-2026-23693

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

More in WordPress

Same weakness CWE-306 – Missing Authentication for Critical Function

Share

External POC / Exploit Code