medium5.4
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-…
Impact
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
Affected products
| Product | Affected versions |
|---|---|
| Simple Membership MailChimp Integration WordPress Plugin | before 1.9.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.