Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92435

Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92435

Published

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92435

Published

Mailchimp for WooCommerce

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Mailchimp for WooCommerce",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "6.1.1"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON