medium5.3
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-suppli…
Impact
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.
Affected products
| Product | Affected versions |
|---|---|
| Mailchimp For WooCommerce WordPress Plugin | before 6.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.