CVE-2026-118166— MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag

Quick assessment

Affected

Unknown MC4WP: Mailchimp for WordPress

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 4.15.0 版本之前的 MC4WP（Mailchimp for WordPress）WordPress 插件中，当表单通过区块（Block）嵌入时，其动态内容标签中源自请求的值未被阻止以短代码（shortcode）形式进行解析。这导致未认证访问者能够执行任意已注册的短代码，并传入攻击者指定的属性。该漏洞的利用前提是：站点管理员已在表单内容中添加了源自请求的标签，且使用区块（而非传统短代码）方式嵌入了表单。

CVSS 4.8 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag

Source: CVE Program / CVE List V5

Vulnerability Description

The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	MC4WP: Mailchimp for WordPress	0 ~ 4.15.0	-

II. Public POCs for CVE-2026-118166

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118166

请登录查看更多情报信息。

Other References for CVE-2026-118166 (1)

https://wpscan.com/vulnerability/a8b2a564-25ae-4ed8-9c2c-989b104ba4c8/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-118166

Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total

CVE-2026-118423	10.0 CRITICAL	WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
CVE-2026-88800	9.1 CRITICAL	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Rol
CVE-2026-88799	8.8 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover
CVE-2026-88801	8.0 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro
CVE-2026-121633	5.3 MEDIUM	Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste
CVE-2026-121636	5.3 MEDIUM	Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the
CVE-2026-113615		GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
CVE-2026-118239		AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth
CVE-2026-118188		PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
CVE-2026-115673		Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email
CVE-2026-118167		MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
CVE-2026-118187		PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
CVE-2026-118186		PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi
CVE-2026-86606		iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
CVE-2026-110813		Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam
CVE-2026-110525		MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
CVE-2026-92396		Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
CVE-2026-12967		WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
CVE-2026-87784		Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
CVE-2026-119259		All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: MC4WP: Mailchimp for WordPress

Same vendor: Unknown