{"affected":[{"defaultStatus":"unaffected","product":"MC4WP: Mailchimp for WordPress","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.15.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118167","cwes":["CWE-863"],"description":"The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/11752539-1dc8-4adb-a680-ce7ecaaff4d1/"}],"kev":null,"metrics":[],"modifiedAt":1793944828080,"publishedAt":1793944828080,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/11752539-1dc8-4adb-a680-ce7ecaaff4d1/"}],"remediation":[],"revision":"9a154c1be81a871f82e2f0698c8828078e791cdb87032c151fe506514f533743","sources":[{"modifiedAt":1793944828080,"name":"CNA: WPScan","retrievedAt":1793945320378,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118167"}],"ssvc":null,"status":"published","title":"MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override","updatedAt":1793945320378}