Mailchimp For Woocommerce
Monthly
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Unauthenticated information disclosure in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows anyone who already knows a customer's email address to retrieve that customer's saved cart contents and confirm that the individual shops at the store. The saved-cart endpoint trusts a request-supplied identifier derived from the customer's email without requiring authentication or verifying ownership, so the attack is remote, needs no credentials and no user interaction, but is limited to read-only disclosure of cart data for accounts whose email the attacker already possesses. Vendor-released patch is available (version 6.3), publicly available exploit code exists, and exploitation has not been confirmed as active (CISA KEV not listed); EPSS is 0.18% (6th percentile), consistent with a low-severity, targeted-reconnaissance issue rather than a mass-exploited one.
Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordPress plugin before 6.1.1 because the permission callback does not verify the requesting user's capability, allowing a persistent state change (CWE-862). Publicly available exploit code exists. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the impact is limited to low integrity with no confidentiality or availability effect, but the unauthenticated nature and available exploit code make this a real, actionable priority driven more by exploitability signals than by raw severity.
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Unauthenticated information disclosure in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows anyone who already knows a customer's email address to retrieve that customer's saved cart contents and confirm that the individual shops at the store. The saved-cart endpoint trusts a request-supplied identifier derived from the customer's email without requiring authentication or verifying ownership, so the attack is remote, needs no credentials and no user interaction, but is limited to read-only disclosure of cart data for accounts whose email the attacker already possesses. Vendor-released patch is available (version 6.3), publicly available exploit code exists, and exploitation has not been confirmed as active (CISA KEV not listed); EPSS is 0.18% (6th percentile), consistent with a low-severity, targeted-reconnaissance issue rather than a mass-exploited one.
Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordPress plugin before 6.1.1 because the permission callback does not verify the requesting user's capability, allowing a persistent state change (CWE-862). Publicly available exploit code exists. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the impact is limited to low integrity with no confidentiality or availability effect, but the unauthenticated nature and available exploit code make this a real, actionable priority driven more by exploitability signals than by raw severity.
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.