Vulnerability · Published Sep 2, 2026 · Assigned by WPScan

CVE-2026-8151Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

Medium 5.4

In plain English

A medium-severity cross-site request forgery in Simple Membership MailChimp Integration from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 96.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Simple Membership MailChimp Integration	0 – before 1.9.8

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/c7002cf8-83db-4e1f-a6e9-230293290635/ exploit, vdb-entry, technical-description
https://plugins.trac.wordpress.org/browser/simple-membership-mailchimp-integration/trunk/swpm-mailchimp-admin-menu.php#L12 patch