The vulnerability is an unauthenticated broken access control flaw in versions of the MailChimp Block plugin up to 1.1.15. It allows an attacker who can access the WordPress site to perform administrative actions normally reserved for authenticated users, potentially modifying or viewing private data. The weakness aligns with CWE‑862, indicating improper enforcement of authorization checks.

The affected product is the MailChimp Block plugin distributed by bPlugins, used within WordPress installations. Versions up to and including 1.1.15 are impacted; newer releases such as 1.1.16 and later contain the fix.

The CVSS score of 8.3 signals a high severity. Because no authentication is required, malicious actors can exploit this without credentials, although precise EPSS data is unavailable. The vulnerability is not listed in the CISA KEV catalog. Potential exploitation would involve sending crafted requests to the plugin's endpoints, leveraging the missing access checks to gain unauthorized control.