CVE-2026-7520

Name of the Vulnerable Software and Affected Versions MailChimp Forms by MailMunch versions prior to 3.2.8

Description The plugin is susceptible to unauthorized data modification because the sign in() and sign up() AJAX handlers lack proper capability checks. Authenticated users with Subscriber-level access or higher can exploit this by submitting their own credentials to relink the site integration to an account they control. This allows the attacker to intercept all subscriber data captured by the forms and control the landing pages rendered on the site.

Recommendations Update the plugin to version 3.2.8 or later. As a temporary mitigation, restrict access to the sign in() and sign up() AJAX handlers for users with Subscriber-level permissions.