CVE-2024-35742: Easy Forms For Mailchimp Auth Bypass

CVE-2024-35742 Overview

CVE-2024-35742 is a Missing Authorization vulnerability [CWE-862] affecting the Code Parrots Easy Forms for Mailchimp plugin for WordPress. The flaw allows unauthenticated attackers to access functionality that should be restricted to authorized users. The issue affects all versions from initial release through 6.9.0. The vulnerability is exploitable over the network without user interaction or prior authentication, making it accessible to remote attackers targeting WordPress sites that have the plugin installed.

Critical Impact
Unauthenticated remote attackers can invoke privileged plugin functionality due to broken access control, with limited impact to confidentiality, integrity, and availability of affected WordPress installations.

Affected Products

Code Parrots Easy Forms for Mailchimp WordPress plugin versions up to and including 6.9.0
WordPress sites using the codeparrots:easy_forms_for_mailchimp component
All deployments where the plugin is installed and active prior to the vendor patch

Discovery Timeline

2024-06-10 - CVE-2024-35742 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35742

Vulnerability Analysis

The vulnerability stems from Missing Authorization [CWE-862] in the Easy Forms for Mailchimp WordPress plugin. The plugin exposes functionality without verifying whether the requesting user has the required capability or role to perform the action. This class of broken access control allows attackers to invoke plugin handlers directly through standard WordPress request channels such as admin-ajax.php or REST endpoints. The attack vector is network-based, requires no privileges, and needs no user interaction. Limited impact is recorded across confidentiality, integrity, and availability, indicating partial access to data or actions rather than full site compromise. The EPSS probability is 0.316%, reflecting low predicted exploitation activity at this time.

Root Cause

The plugin's request handlers do not perform capability checks such as current_user_can() or nonce validation through check_admin_referer() before executing sensitive operations. Without these guards, the WordPress permission model is effectively bypassed for the affected endpoints.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the vulnerable plugin endpoints on a target WordPress site. Because authorization is not enforced, the server processes the request and executes the underlying action. Refer to the Patchstack Vulnerability Advisory for endpoint-level technical details.

Detection Methods for CVE-2024-35742

Indicators of Compromise

Unauthenticated POST or GET requests to plugin-specific actions under admin-ajax.php referencing Easy Forms for Mailchimp handlers
Unexpected modifications to Mailchimp form configurations or list integrations on affected WordPress sites
Web server access logs showing repeated probing of plugin endpoints from a single source IP

Detection Strategies

Inventory WordPress installations and identify any running Easy Forms for Mailchimp at version 6.9.0 or earlier
Inspect HTTP request logs for calls to plugin handlers originating from unauthenticated sessions
Correlate access log anomalies with WordPress audit logs for changes performed without an authenticated administrator session

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for retention and query
Alert on spikes of requests to admin-ajax.php with plugin-specific action parameters
Track plugin version inventories across managed WordPress sites to detect unpatched instances

How to Mitigate CVE-2024-35742

Immediate Actions Required

Update the Easy Forms for Mailchimp plugin to a version later than 6.9.0 as soon as a fixed release is available from the vendor
Audit the WordPress site for unauthorized configuration changes since the plugin was installed
Restrict access to /wp-admin/admin-ajax.php at the web application firewall layer where feasible

Patch Information

No vendor advisory URL is listed in the NVD record. Consult the Patchstack Vulnerability Advisory for fix availability and version guidance. Apply the fixed version through the WordPress plugin updater once published.

Workarounds

Disable and remove the Easy Forms for Mailchimp plugin until a patched version is installed
Deploy WAF rules to block unauthenticated requests to the affected plugin action parameters
Limit administrative access to WordPress through IP allowlisting where operationally feasible

bash

# Example: list active WordPress plugins and versions using WP-CLI
wp plugin list --status=active --fields=name,version | grep -i mailchimp

# Example: deactivate the vulnerable plugin pending a patch
wp plugin deactivate easy-forms-for-mailchimp