Read the docs
TI-2026-86153 Aliases CVE-2026-27356GHSA-gqc2-g7c3-2x8v

Missing authorization in MC4WP WordPress plugin lets attackers modify data

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The ibericode MC4WP (mailchimp-for-wp) WordPress plugin through 4.14.1 is affected. A missing authorization check (CWE-862) means access control is not enforced as intended. An unauthenticated remote attacker can change data with low integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1.

Why it matters now

EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dvankootenMC4WPup to 4.14.1—No fix listedCNA
  • MC4WP Vendordvankooten Affected up to 4.14.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for MC4WP.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-27356
  2. 2026-11-07 Alias added: GHSA-gqc2-g7c3-2x8v

References

Other 1

  • TI-2026-18342 SQL injection in dvankooten koko-analytics CVSS 3.1HIGH 8.4
  • TI-2026-01464 MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion CVSS 3.1MEDIUM 6.5
  • TI-2024-08546 MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2017-13750 The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. CVSS 3.0MEDIUM 6.1
  • TI-2016-08909 The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. CVSS 3.0MEDIUM 6.1
  • TI-2026-03965 Cross-site scripting in dvankooten MC4WP: Mailchimp for WordPress CVSS 3.1MEDIUM 6.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences