MailChimp Forms by MailMunch <= 3.2.7 — Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Mailmunch Forms for Mailchimp.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.2.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Mailmunch Forms for Mailchimp to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to t0ann9uy3n.

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Aug 4, 2026

   CVE published

   Severity high, CVSS 8.1

2. Nov 13, 2026

   Record last updated