CVE-2025-12172: Mailchimp WordPress Plugin CSRF Flaw

CVE-2025-12172 Overview

CVE-2025-12172 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Mailchimp List Subscribe Form plugin for WordPress. The flaw exists in all versions up to and including 2.0.0. The vulnerability stems from missing or incorrect nonce validation on the mailchimp_sf_change_list_if_necessary() function. Unauthenticated attackers can change the configured Mailchimp list by tricking a site administrator into clicking a crafted link or visiting a malicious page. Successful exploitation does not grant code execution but disrupts subscriber list configuration on affected WordPress sites.

Critical Impact

Unauthenticated attackers can alter the Mailchimp list associated with a WordPress site by inducing an authenticated administrator to perform a single click on an attacker-controlled link.

Affected Products

• Mailchimp List Subscribe Form plugin for WordPress, all versions up to and including 2.0.0
• WordPress sites with administrator users who can be socially engineered
• Sites relying on Mailchimp List Subscribe Form for newsletter list management

Discovery Timeline

• 2026-02-19 - CVE-2025-12172 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12172

Vulnerability Analysis

The vulnerability is a classic CSRF flaw in a WordPress plugin's administrative function. The mailchimp_sf_change_list_if_necessary() function processes requests that modify the Mailchimp list bound to the site's subscribe form. WordPress provides a nonce mechanism designed to ensure that state-changing requests originate from legitimate, intentional user actions within the admin interface. The plugin either omits the nonce check or implements it incorrectly on this code path. As a result, the server accepts requests that lack proof of user intent.

An attacker hosts a page that issues a forged request to the vulnerable endpoint. When an authenticated WordPress administrator visits the page, the browser automatically attaches the session cookies, and the plugin processes the request as legitimate. The user-interaction requirement and the limited integrity impact reflect that exploitation depends on social engineering and only modifies plugin configuration.

Root Cause

The root cause is the absence of, or flawed implementation of, a WordPress nonce check inside mailchimp_sf_change_list_if_necessary(). Functions that change plugin state must validate a nonce using check_admin_referer() or wp_verify_nonce() along with a capability check. Without that validation, the function trusts that any incoming request from an authenticated browser session is legitimate.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts an HTML page containing a form or image tag that targets the vulnerable plugin endpoint on a known WordPress site. The attacker lures a logged-in administrator to that page through phishing, a forum post, or a malicious comment. On page load, the administrator's browser submits the forged request with valid authentication cookies, and the plugin switches the active Mailchimp list. No credentials or prior site access are required by the attacker.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset.

Detection Methods for CVE-2025-12172

Indicators of Compromise

• Unexpected changes to the configured Mailchimp list ID in the plugin settings without a corresponding administrator action in audit logs
• HTTP POST or GET requests to admin.php or admin-ajax.php invoking mailchimp_sf_change_list_if_necessary with Referer headers pointing to external domains
• Administrator session activity in web server logs that coincides with cross-origin referers shortly before list configuration changes

Detection Strategies

• Compare current plugin configuration against a known-good baseline of the Mailchimp list identifier and flag deviations
• Inspect web server access logs for requests to plugin admin endpoints that include external Referer headers or no referer at all
• Review WordPress audit logs, where available, for plugin option updates that lack a matching administrator console session

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized logging or SIEM platform and alert on plugin option changes
• Track wp_options table writes related to the Mailchimp List Subscribe Form plugin and correlate them with admin login events
• Monitor outbound email subscription destinations to detect cases where new subscribers are routed to an unexpected Mailchimp list

How to Mitigate CVE-2025-12172

Immediate Actions Required

• Update the Mailchimp List Subscribe Form plugin to the version published after the fix commit referenced in the WordPress plugin changeset
• Verify and restore the correct Mailchimp list identifier in the plugin configuration if tampering is suspected
• Require administrators to log out of WordPress sessions when not actively managing the site to reduce CSRF exposure

Patch Information

The fix is published in the WordPress plugin repository. The remediation adds proper nonce validation to the affected request handler. Review the WordPress Plugin Changeset for the exact code changes and install the patched release through the WordPress plugin manager.

Workarounds

• Deactivate the Mailchimp List Subscribe Form plugin until the patched version is installed
• Restrict administrative access to the WordPress dashboard using IP allowlists at the web server or WAF layer
• Configure a web application firewall rule to block requests to the plugin endpoint that lack a same-origin Referer header

# Example WAF rule concept to block cross-origin requests to the vulnerable endpoint
# Replace example.com with the protected site's hostname
SecRule REQUEST_URI "@contains mailchimp_sf_change_list_if_necessary" \
  "id:1012172,phase:1,deny,status:403,\
   chain,msg:'Block cross-origin CSRF to Mailchimp List Subscribe Form'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://example.com/"