The Mailchimp List Subscribe Form plugin for WordPress contains a Cross‑Site Request Forgery flaw due to missing or incorrect nonce validation in the mailchimp_sf_change_list_if_necessary() function. This flaw allows an unauthenticated attacker, by tricking a site administrator into clicking a forged link, to change the Mailchimp list that the form subscribes to. The change can redirect subscriptions to an attacker‑controlled list, potentially compromising email data integrity and trust.

All installations of the Mailchimp List Subscribe Form plugin for WordPress up to and including version 2.0.0 are affected. No specific smaller sub‑versions are listed, so any release with a version number of 2.0.0 or earlier is vulnerable.

The vulnerability rates a moderate CVSS score of 4.3 and a very low EPSS score of < 1 %. It is not listed in the CISA KEV catalog. Because the attack requires an authenticated administrator to interact with a forged request, the attacker’s success hinges on social engineering or user interaction. Once successful, the attacker gains the ability to alter list configuration, providing a channel to redistribute or harvest subscriber data.