A missing authorization check in the kamleshyadav CF7 7 Mailchimp Add-on plugin allows an attacker to exploit incorrectly configured access control security levels. This flaw can enable an unauthorized user to perform actions that are normally restricted to privileged users, such as submitting or retrieving configuration data for the Mailchimp integration.

The vulnerability affects the WordPress CF7 7 Mailchimp Add-on plugin (vendor kamleshyadav) in all releases before version 2.4. Sites running any of these older versions are potentially exposed.

With a CVSS score of 5.3, the flaw is considered moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, where a malicious actor can send crafted HTTP requests to the plugin’s endpoints that bypass normal authentication checks. If exploited, the attacker could gain unauthorized access to configuration settings or other privileged operations within the plugin.