Vulnerability · Published Oct 3, 2026 · Assigned by WPScan
CVE-2026-92437Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion
Medium 5.3
In plain English
A medium-severity missing authorization in Mailchimp for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Mailchimp for WooCommerce | 0 – before 6.3 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/47b3aa17-f7fd-42df-9ef0-e33b5da8f955/ exploit, vdb-entry, technical-description