CVE-2026-8151 — Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator i…
Published: 2026-09-02 · CVSS: 5.4 · CVSS 3.1
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7