Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92437)
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92437
Risk Score
Threat Entry
Updated 2026-09-28
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92436)
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92436
Risk Score
Threat Entry
Updated 2026-09-21
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92435)
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92435
Risk Score
Threat Entry
Updated 2026-10-23
Mailchimp For Woocommerce - SQL Injection (CVE-2026-73346)
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
PLUGIN
Mailchimp For Woocommerce
CVE-2026-73346
Risk Score
Threat Entry
Updated 2026-06-17
Mailchimp For Woocommerce - Security Vulnerability (CVE-2022-2267)
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
PLUGIN
Mailchimp For Woocommerce
CVE-2022-2267
Risk Score
Threat Entry
Updated 2026-06-17
Mailchimp For Woocommerce - Security Vulnerability (CVE-2022-2556)
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
PLUGIN
Mailchimp For Woocommerce
CVE-2022-2556
Risk Score