The vulnerability is in the mcbSubmit_Form_Data() routine of the Block for Mailchimp plugin for WordPress. It allows unauthenticated attackers to cause the application to send HTTP requests to any URL specified in the request, including internal service endpoints. Because the responses are not returned to the attacker, this is a blind SSRF. The potential impact is that the attacker can query or change information on internal services that the WordPress site can reach.

All WordPress sites that run the Block for Mailchimp – Add Email Subscription Forms and Collect Leads plugin version 1.1.12 or earlier are affected.

The CVSS score of 4 indicates a medium baseline risk. The EPSS score of less than 1% indicates exploitation is uncommon. The vulnerability is not listed in CISA’s KEV catalog. Attackers only need to submit a crafted form to trigger the SSRF, which can be done from any remote location. The impact is limited to server‑side requests; because no data is returned, no direct exfiltration is possible, but the ability to reach internal services could be leveraged within environments where the network is poorly segmented.