CVE-2026-118167

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1181685.3The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthen CVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'con CVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-1181709.1The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe CVE-2026-1181716.5The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privi CVE-2026-1181726.1The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat CVE-2026-1181736.1MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. CVE-2026-1181746.5When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer import CVE-2026-1181757.5When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the CVE-2026-1181768.1Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt CVE-2026-1181779.1When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted cale CVE-2026-1181785.7A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.