Simple Membership Mailchimp Integration
Monthly
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.