Vulnerabilities and security researches formailchimp-forms-by-mailmunch mailchimp-forms-by-mailmunch

Jun 06, 2024

CVE, Research URL: b1fde7e92b7824b9cdce68b49551399123e4d32b
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Aug 11, 2023
Research Description: MailChimp Forms by MailMunch [mailchimp-forms-by-mailmunch] < 3.1.5 WordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Broken Access Control No patched version is available. Lana Codes discovered and reported this Broken Access Control vulnerability in WordPress MailChimp Forms by MailMunch Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.
Affected versions: max 3.1.5.
Status: vulnerable

CVE, Research URL: CVE-2023-45748
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Oct 16, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions.
Affected versions: max 3.1.8.
Status: vulnerable

CVE, Research URL: CVE-2024-31378
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Apr 15, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.1.
Affected versions: max 3.2.2.
Status: vulnerable

CVE, Research URL: CVE-2024-29793
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Mar 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.
Affected versions: max 3.2.3.
Status: vulnerable

Jun 10, 2024

CVE, Research URL: CVE-2023-40203
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Dec 13, 2024
Research Description: Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
Affected versions: max 3.1.5.
Status: vulnerable

Nov 21, 2024

CVE, Research URL: CVE-2024-8726
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Nov 20, 2024
Research Description: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.2.4.
Status: vulnerable

Aug 06, 2026

CVE, Research URL: CVE-2026-7520
Home page URL: Security reports for MailChimp Forms by MailMunch
Application: MailChimp Forms by MailMunch
Date: Aug 05, 2026
Research Description: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
Affected versions: max 3.2.8.
Status: vulnerable