CVE-2026-8151

MediumCVSS 5.4/10Last modified Sep 3, 2026

Description

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Simple Membership MailChimp Integration	< 1.9.8

References

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-815157.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815167.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti CVE-2026-815177.5An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection lo CVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake b CVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spa CVE-2026-815207.5A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by be CVE-2026-815216.5The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator charact CVE-2026-815228.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identif CVE-2026-815234.4A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without saniti CVE-2026-815258.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before usin CVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it