The vulnerability is a missing authorization flaw in the MC4WP Mailchimp for WP plugin. An attacker who can trigger the plugin’s endpoints may perform actions that should be restricted to privileged users, potentially disclosing or altering customer data. This weakness is a classic missing authorization problem (CWE‑862).

WordPress sites using the ibericode MC4WP Mailchimp for WP plugin version 4.14.1 or earlier. The vulnerability applies to all versions from the earliest available through 4.14.1.

The CVSS score of 5.3 indicates moderate risk. The EPSS is not reported, so there is no known exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through web requests to the plugin’s administrative endpoints, and no privileged access to the WordPress system is required to exploit the missing permission check.