EUVD-2026-53287
GHSA-49m8-524g-8rr2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
PR:L confirmed by subscriber-level requirement; AV:N for AJAX endpoint; C:H and I:H for data exfiltration and form content hijacking; A:N as availability is unaffected.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sign_in() and sign_up() AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
AnalysisAI
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the sign_in() and sign_up() AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid WordPress account with at minimum Subscriber-level access on the target site - this is the lowest default role in WordPress, typically granted automatically upon user registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the severity: network-accessible, low complexity, requiring only subscriber-level access, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running the vulnerable plugin, then sends a crafted HTTP POST to the site's `wp-admin/admin-ajax.php` endpoint with `action=mailmunch_sign_in` and their own MailMunch account credentials as parameters. The plugin accepts and stores these credentials without authorization checks, relinking the integration to the attacker's MailMunch workspace. … |
| Remediation | Update the MailChimp Forms by MailMunch plugin to version 3.2.8 immediately; this is confirmed as the patched release via the WordPress plugin repository changeset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit and document all WordPress users with subscriber-level and higher privileges; disable the plugin immediately if lead generation is not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today