Description
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mailmunch Mailmunch Forms for Mailchimp
Default version status: unaffected
0 to ≤ 3.2.7affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d00ee8-b9df-4044-a5e2-320391d6c9b1?source=cve ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/trunk/admin/class-mailchimp-mailmunch-admin.php#L134 ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/tags/3.2.7/admin/class-mailchimp-mailmunch-admin.php#L134 ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/tags/3.2.7/admin/class-mailchimp-mailmunch-admin.php#L126 ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/tags/3.2.7/includes/class-mailmunch-api.php#L354 ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/tags/3.2.7/includes/class-mailmunch-api.php#L371 ↗
- https://plugins.trac.wordpress.org/browser/mailchimp-forms-by-mailmunch/tags/3.2.7/includes/class-mailchimp-mailmunch.php#L219 ↗
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3593826%40mailchimp-forms-by-mailmunch%2Ftags%2F3.2.8&old=3445363%40mailchimp-forms-by-mailmunch%2Ftags%2F3.2.7 ↗