Mailmunch Forms For Mailchimp
Monthly
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.