WordPress MailChimp Forms by MailMunch Missing Authorization Leading to Account Takeover CVE-2026-7520

Vulnerability Overview Vulnerability Name: MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action CVE ID: CVE-2026-7520 CVSS Score: 8.1 (High) Publication Date: August 4, 2026 Last Updated: August 5, 2026 Researcher: 10fansRyu3n Scope of Impact Software Type: Plugin Software Name: MailChimp Forms by MailMunch Affected Versions: <= 3.2.7 Fixed Version: 3.2.8 Remediation Remediation Measure: Upgrade to version 3.2.8 or later. Vulnerability Description This vulnerability exists in the MailChimp Forms by MailMunch plugin due to a lack of capability checks on the 'sign_in' and 'sign_up' AJAX handlers, leading to unauthorized data modification. An attacker can exploit this vulnerability by submitting attacker-provided credentials to re-link the website's MailMunch integration to a MailMunch account controlled by the attacker. Once re-linked, all subscriber data will be captured by the attacker, and the forms/landing pages presented on the site will be fetched from the attacker's MailMunch account. References plugins.trac.wordpress.org Additional Information Package: Mailmunch Forms for Mailchimp Package Link: mailchimp-forms-by-mailmunch Recent Vulnerabilities MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-8726 - CVSS Score: 6.1 - Researcher: vgo0 - Publication Date: November 19, 2024 MailChimp Forms by MailMunch <= 3.2.1 - Cross-Site Request Forgery - CVE ID: CVE-2024-31378 - CVSS Score: 4.3 - Researcher: Majed Refaea - Publication Date: April 10, 2024 MailChimp Forms by MailMunch <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2024-29793 - CVSS Score: 6.4 - Researcher: Ngô Thiên An (ancon_) - Publication Date: March 25, 2024 MailChimp Forms by MailMunch <= 3.1.7 - Cross-Site Request Forgery via Multiple AJAX actions - CVE ID: CVE-2023-45748 - CVSS Score: 5.4 - Researcher: Abdi Pranata - Publication Date: October 12, 2023 MailChimp Forms by MailMunch <= 3.1.4 - Missing Authorization via multiple AJAX actions - CVE ID: CVE-2023-40203 - CVSS Score: 5.4 - Researcher: István Márton - Publication Date: August 11, 2023 Summary This vulnerability involves unauthorized data modification in the MailChimp Forms by MailMunch plugin, affecting versions <= 3.2.7. Users are advised to upgrade to version 3.2.8 or later as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress MailChimp Forms by MailMunch Missing Authorization Leading to Account Takeover CVE-2026-7520

More from this source