The Royal Addons for Elementor plugin before version 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credentials to add subscriber records to an audience chosen by the request. This flaw allows unauthenticated attackers to inject arbitrary email addresses and contact details, resulting in those entries being created as confirmed subscribers in the victim’s Mailchimp account.

WordPress sites that have installed Royal Addons for Elementor versions 1.3.71 through 1.7.1069 inclusive and have Mailchimp integration enabled are affected. Sites using earlier or later versions, or without the integration configured, are not impacted.

The CVSS score is not disclosed and the EPSS score is not available, indicating the risk is not quantified, but the vulnerability is not listed in CISA KEV, which suggests limited known exploitation. The vulnerability can be exploited trivially by any unauthenticated user who knows the target site’s URL; by crafting a HTTP request to the mailchimp_subscribe endpoint and providing the desired audience ID and subscriber information, the attacker can add confirmed contacts to the victim’s Mailchimp account. Because the subscription is marked as confirmed, these contacts appear automatically without further confirmation steps.