Mailchimp For Woocommerce
Monthly
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.