WordPress security by component
Mailmunch Forms for Mailchimp
Plugin description
Mailmunch Forms for Mailchimp is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 8.1.
Plugin slug:
mailchimp-forms-by-mailmunchLatest vulnerability
CVE-2026-7520: MailMunch subscriber relinking diverts captured subscribers and site forms
Mailmunch Forms for Mailchimp through 3.2.7 omits capability checks from the sign_in() and sign_up() AJAX handlers. A Subscriber can submit credentials for an attacker-controlled MailMunch account and relink the site's integration. Newly captured subscriber data is then delivered to the attacker, while forms and landing pages rendered on the WordPress site are loaded from the attacker's account. The CNA does not disclose the AJAX action or credential parameter names.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-7520
MailMunch subscriber relinking diverts captured subscribers and site forms
Mailmunch Forms for Mailchimp through 3.2.7 omits capability checks from the sign_in() and sign_up() AJAX handlers. A Subscriber can submit credentials for an attacker-controlled MailMunch account and relink the site's integration. Newly captured subscriber data is then delivered to the attacker, while forms and landing pages rendered on the WordPress site are loaded from the attacker's account. The CNA does not disclose the AJAX action or credential parameter names.
|
3.2.8 |
CVE8.1
NVDPending
|
| Apr 15, 2024 |
CVE-2024-31378
MailChimp Forms by MailMunch: Cross-site request forgery
MailChimp Forms by MailMunch is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE5.4
NVD8.8
|
| Mar 27, 2024 |
CVE-2024-29793
MailChimp Forms by MailMunch: Cross-site scripting
MailChimp Forms by MailMunch is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Oct 16, 2023 |
CVE-2023-45748
Mailchimp Forms By Mailmunch: Cross-site request forgery
Mailchimp Forms By Mailmunch is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVD8.8
|