Technical impact
The CVE reveals that the MC4WP: Mailchimp for WordPress plugin accepts an unvalidated POST parameter named _mc4wp_action. This flaw allows an unauthenticated user to trigger an unsubscribe operation instead of the intended subscribe action. The effect is that an attacker can remove any email address from the configured Mailchimp audience, compromising the integrity of the marketing list. The weakness is identified as CWE-862 (Missing Authorization) and manifests as a moderate severity vulnerability with a CVSS score of 6.5.
Affected Systems
All installations of the MC4WP: Mailchimp for WordPress plugin up to, and including, version 4.11.1 are affected. The vulnerability is triggered via a publicly exposed form ID, which is displayed in the page’s HTML source. The plugin is developed by dvankooten:MC4WP: Mailchimp for WordPress and is used in WordPress sites that integrate with Mailchimp audiences.
Risk and Exploitability
The risk level is moderate (CVSS 6.5) with an exploit probability of less than 1% as indicated by EPSS. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a simple HTTP POST request to the form endpoint with the _mc4wp_action parameter set to trigger an unsubscribe, provided they know the public form ID. No authentication is required, making the attack straightforward for any user on the internet.
