CVE-2026-8151 The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings…

Description

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Affected products and versions