What is the CVSS score of CVE-2026-25430?

CVE-2026-25430 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25430?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Integration For Mailchimp And Contact Form 7 Wpforms Elementor Ninja Forms CVE-2026-25430

Q: Which versions of Integration For Mailchimp And Contact Form 7 Wpforms Elementor Ninja Forms are affected by CVE-2026-25430?

CVE-2026-25430 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

EUVD-2026-15725 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-9qg3-cr7q-92v5

Authentication Bypass Integration For Mailchimp And Contact Form 7 Wpforms Elementor Ninja Forms Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15725

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.

AnalysisAI

The CRM Perks Integration plugin for Mailchimp (versions through 1.2.2) contains a missing authorization flaw that allows authenticated attackers to modify data through incorrectly configured access controls. An attacker with user-level permissions could bypass authorization checks to alter form submissions and contact information across integrated platforms including Contact Form 7, WPForms, Elementor, and Ninja Forms. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability stems from improper implementation of authorization checks in the CRM Perks Integration plugin (CPE: cpe:2.3:a:crm_perks:integration_for_mailchimp_and_contact_form_7,_wpforms,_elementor,_ninja_forms), which serves as a WordPress bridge integrating Mailchimp with popular form-building plugins including Contact Form 7, WPForms, Elementor, and Ninja Forms. The root cause is classified under CWE-862 (Missing Authorization), indicating that the plugin fails to properly verify user permissions before allowing access to sensitive operations or data related to Mailchimp integration settings, API credentials, or form submission handling. This type of vulnerability typically arises from missing capability checks (such as WordPress's current_user_can() function) in admin AJAX handlers or REST API endpoints, allowing any authenticated or unauthenticated user to manipulate form data, retrieve Mailchimp credentials, or modify integration configurations.

RemediationAI

Update the CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin to a patched version beyond 1.2.2 immediately. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cf7-mailchimp/vulnerability/wordpress-integration-for-mailchimp-and-contact-form-7-wpforms-elementor-ninja-forms-plugin-1-2-2-broken-access-control-vulnerability) for the exact patched version number and installation instructions. As a temporary mitigation, restrict WordPress admin and form access to trusted IP ranges using a Web Application Firewall or reverse proxy, and audit WordPress user roles to ensure only necessary users have editor or administrator capabilities that could interact with form integrations. Additionally, monitor Mailchimp API logs for unauthorized access attempts and consider rotating Mailchimp API keys if the plugin has been deployed in a publicly accessible environment for an extended period.