An attacker can introduce arbitrary request‑derived dynamic tags into a form rendered by the MC4WP: Mailchimp for WordPress plugin. Those tags are processed as shortcodes, allowing the visitor to execute any registered shortcode with attacker‑controlled attributes. The result is potential code execution, arbitrary data exposure, or other damage, depending on the capabilities of the shortcodes used. The vulnerability is an instance of code injection through untrusted dynamic content.

The flaw exists in the MC4WP: Mailchimp for WordPress WordPress plugin for all versions prior to 4.15.0. Any WordPress site that has installed that plugin and has embedded a form using the block editor can be impacted. The plugin’s dynamic content tag feature must have been added to the form content by the site owner and rendered via the block editor rather than the classic shortcode.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not provided. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an unauthenticated visitor to load a page containing a form block that includes a request‑derived dynamic tag; the tag is then interpreted as a shortcode and executed. Because the attacker can choose any shortcode and its attributes, the real impact depends on which shortcodes are registered on the site. Exploitation is limited to sites that use the affected plugin version and have enabled the vulnerable feature, but once the condition is met, it does not require additional privileges.