5.3
Medium
CVE-2026-92436 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before…
Description
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mailchimp for WooCommerce 6.3 | earliest → < 6.3 | 6.3 |
Other CVEs of Mailchimp for WooCommerce
The 5 CVEs of Mailchimp for WooCommerce →
CVE-2026-92437
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check…
5.3
Medium
CVE-2026-92435
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the…
5.3
Medium
CVE-2022-2556
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to…
Not rated
CVE-2022-2267
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such…
Not rated