Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-92435
PublishedThe Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-92435
PublishedMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
- Source published
- 19 Sep 2026 06:00:18 UTC
- Source modified
- 19 Sep 2026 13:16:26 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.