EUVD-2026-91945
GHSA-g66g-hh39-fx5j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated, network-reachable, no user interaction (PR:N/UI:N/AV:N/AC:L); impact limited to tampering/deleting another customer's cart, so I:L with no confidentiality and no system-level availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
AnalysisAI
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, nonce, or ownership check is required: the plugin acts on a customer's abandoned-cart record identified from request-supplied data, so any remote actor who can reach the endpoint can target another customer's cart. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward a genuine-but-moderate priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Mailchimp for WooCommerce plugin to version 6.3 or later, which is the vendor-released fix; the patch is confirmed available from the vendor and the WPScan advisory (https://wpscan.com/vulnerability/47b3aa17-f7fd-42df-9ef0-e33b5da8f955/) tracks affected and fixed versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mailchimp For Woocommerce
View allUnauthenticated information disclosure in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows anyon
Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordP
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated adminis
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perfo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today