MailMunch Forms EUVD-2026-53287

The attacker must hold a valid WordPress account with at minimum Subscriber-level access on the target site - this is the lowest default role in WordPress, typically granted automatically upon user registration. The attacker must also possess or create a MailMunch account to relink to. Exploitation is blocked if the site disables user registration and the attacker has no other path to a WordPress account. The vulnerability is not exploitable by unauthenticated visitors. No special plugin configuration or feature flag is required - the vulnerable AJAX handlers are registered unconditionally in all affected versions. Exploitation does not require admin access, elevated OS privileges, or any interaction from site administrators or editors.

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the severity: network-accessible, low complexity, requiring only subscriber-level access, with high confidentiality and integrity impact. The real-world risk is significant for any site that uses this plugin to capture leads or run campaigns, because the attacker gains persistent data access and content injection capability without any visible disruption. The primary limiting factor is the PR:L requirement - exploitation demands a valid WordPress account, which constrains opportunistic mass exploitation but does not meaningfully protect sites with open registration or in multi-tenant environments. No EPSS data was provided in the intelligence feed, and the vulnerability is not currently listed in CISA KEV, suggesting no confirmed widespread active exploitation as of analysis time. However, the simplicity of the attack - a crafted AJAX POST with attacker credentials - makes it accessible to low-skill actors. The Wordfence disclosure and source code references confirm the vulnerability is well-documented.

An attacker registers a free subscriber account on a WordPress site running the vulnerable plugin, then sends a crafted HTTP POST to the site's wp-admin/admin-ajax.php endpoint with action=mailmunch_sign_in and their own MailMunch account credentials as parameters. The plugin accepts and stores these credentials without authorization checks, relinking the integration to the attacker's MailMunch workspace. From that point forward, all email addresses and data submitted through the site's contact and subscription forms are delivered silently to the attacker's account, and the attacker can modify the forms and landing pages rendered on the victim site.