The vulnerability resides in the ElementsKit Elementor Addons WordPress plugin, affecting versions earlier than 3.7.9. It exposes the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without requiring authentication. An attacker can supply arbitrary Mailchimp API credentials and craft requests that the plugin forwards to the Mailchimp service. Because the plugin does not validate important parameters such as the list identifier, the endpoint can be used as an open proxy to perform unauthorized API operations, including adding or removing subscribers, altering list contents, or exhausting the victim’s Mailchimp account limits. The result is unauthorized data manipulation, potential spam, and increased resource usage on the affected WordPress site.

The affected product is the ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor plugin developed by Roxnor. All deployed installations running a version earlier than 3.7.9 are susceptible. No specific sub‑versions are further narrowed by the advisory.

The CVSS score of 9.3 signals a high‑risk flaw. The EPSS indicates that the probability of exploitation is currently very low, as shown by the < 1% score. The vulnerability is not listed in CISA’s KEV catalog. The exploitable path involves sending crafted HTTP requests to the unauthenticated REST endpoint over the public network, which is possible from any host with internet access. Because the attacker does not need privileged credentials on the WordPress server, the threat landscape is broad and the potential impact spans unauthorized email marketing activity, quota depletion, and unintended service consumption.