What is the CVSS score of CVE-2026-56063?

CVE-2026-56063 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of MailChimp Block are affected by CVE-2026-56063?

The WordPress MailChimp Block plugin (versions 1.1.15 and earlier) contains an unpatched broken access control vulnerability that allows unauthenticated attackers to invoke protected plugin functions…

How to fix or mitigate CVE-2026-56063?

Within 24 hours: Identify all WordPress installations using MailChimp Block plugin v1.1.15 or earlier through plugin audit tools or hosting provider reports. Within 7 days: Disable or uninstall the plugin from all affected systems; if removal is operationally infeasible, implement WAF rules to restrict access to the plugin's endpoints. Within 30 days: Monitor Patchstack advisories and the WordPress plugin repository for a released patch; develop and test a deployment plan to apply the patch immediately upon vendor release.

MailChimp Block CVE-2026-56063

EUVD-2026-39717 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-h75p-rhw9-w8q8

WordPress Authentication Bypass Wordpress Plugin

8.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

8.3 HIGH

Unauthenticated, low-complexity network access to an endpoint missing authorization (AV:N/AC:L/PR:N/UI:N); scope change and bounded low impact mirror the source vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:57 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

AnalysisAI

Broken access control in the WordPress "MailChimp Block" plugin (versions 1.1.15 and earlier) lets unauthenticated remote attackers invoke protected plugin functionality without any authorization check, per the CVSS:3.1 vector (AV:N/PR:N/UI:N) and Patchstack's CWE-862 classification. The scope-changed vector (S:C) with low confidentiality, integrity, and availability impact indicates the missing authorization can affect resources beyond the vulnerable component itself. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is the "MailChimp Block" (slug: block-for-mailchimp) WordPress plugin, which adds a Gutenberg block for embedding MailChimp newsletter signup forms. The root cause is CWE-862 (Missing Authorization): one or more plugin actions - typically AJAX or REST endpoints registered via WordPress hooks - fail to perform a capability or nonce check before executing, so the access-control logic that should gate the function is simply absent. Patchstack tags this as an "Authentication Bypass," consistent with the CVSS PR:N value meaning no privileges are required to reach the vulnerable code path.

RemediationAI

No vendor-released patch version is identified in the available data; the input only confirms that versions up to and including 1.1.15 are vulnerable. Administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/block-for-mailchimp/vulnerability/wordpress-mailchimp-block-plugin-1-1-15-broken-access-control-vulnerability?_s_id=cve) and the WordPress plugin page for any release newer than 1.1.15, and upgrade once a fixed version is published. As compensating controls until a patch is confirmed, restrict access to the plugin's AJAX/REST endpoints at the web server or WAF layer (Patchstack offers a virtual patch for this CVE), or deactivate and remove the MailChimp Block plugin if the newsletter-block functionality is non-essential - the trade-off being loss of the signup form block on affected pages. Blocking unauthenticated requests to the specific plugin action handlers is preferable to broad blocking, which may break legitimate front-end form submissions.