Mailchimp WooCommerce EUVD-2026-57911

Exploitation requires an active WordPress administrator session (PR:H per CVSS vector) - the highest privilege tier in a WordPress installation, above shop manager, editor, and subscriber roles. The MailChimp For WooCommerce plugin must be installed and active on the target WordPress/WooCommerce site running a version below 6.2. No non-default WordPress configuration is required beyond having the plugin enabled. Limiting factors: the attacker must first possess valid administrator credentials, which is not trivially obtained and gates all opportunistic exploitation; unauthenticated users and lower-privilege roles (including WooCommerce shop managers) cannot reach the vulnerable functionality. The attack is executable over the network without additional user interaction once admin access is established.

The CVSS 7.6 High score is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), but PR:H fundamentally constrains real-world exploitability - only authenticated WordPress administrators can reach the vulnerable endpoint, which significantly narrows the attack surface to insider threats, compromised credentials, or session hijacking scenarios. No EPSS score, KEV listing, or public exploit code was present in the source intelligence, so exploitation probability and active threat activity remain unconfirmed. The practical risk calculus means that even a mid-sized regional e-commerce operator in boleslawiec should treat patching as a routine maintenance priority rather than an emergency response, while simultaneously ensuring WordPress admin accounts are protected by multi-factor authentication, since credential compromise is the prerequisite that makes this flaw dangerous. The absence of an integrity impact (I:N) in the CVSS vector suggests the injection is read-only, limiting blast radius to data exfiltration rather than data manipulation or service destruction.

An attacker who has acquired WordPress administrator credentials - through phishing, credential stuffing against reused passwords, or a compromised admin session - logs into the WordPress admin panel and navigates to the MailChimp For WooCommerce plugin settings or management pages. The attacker submits a crafted request containing SQL metacharacters in a vulnerable parameter, causing the plugin to execute an attacker-controlled database query. The resulting query can extract customer email addresses, hashed passwords, order details, and other sensitive records from the WordPress database without triggering standard integrity controls.