CVE-2026-23693: ElementsKit Auth Bypass Vulnerability

CVE-2026-23693 Overview

CVE-2026-23693 is a critical vulnerability affecting the ElementsKit Elementor Addons WordPress plugin (elementskit-lite) in versions prior to 3.7.9. The vulnerability stems from an unauthenticated REST API endpoint that can be abused as an open proxy to Mailchimp services, enabling attackers to perform unauthorized API calls without any authentication.

The vulnerable endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe accepts client-supplied Mailchimp API credentials and fails to properly validate certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. This authentication bypass vulnerability (CWE-306: Missing Authentication for Critical Function) allows remote attackers to exploit affected WordPress installations for malicious purposes.

Critical Impact

Unauthenticated attackers can abuse affected WordPress sites as open proxies to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the target WordPress installation.

Affected Products

• ElementsKit Elementor Addons (elementskit-lite) WordPress plugin versions prior to 3.7.9
• WordPress installations with vulnerable ElementsKit plugin versions
• Sites using ElementsKit's Mailchimp integration widget

Discovery Timeline

• 2026-02-23 - CVE-2026-23693 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-23693

Vulnerability Analysis

This vulnerability represents a significant authentication bypass issue in the ElementsKit Elementor Addons plugin for WordPress. The core problem lies in the implementation of the Mailchimp subscription REST endpoint, which was designed to facilitate newsletter signups but lacks proper access controls.

The endpoint processes incoming requests containing Mailchimp API credentials supplied by the client, rather than using server-side stored credentials. This design flaw allows any unauthenticated user to send arbitrary requests through the WordPress site to Mailchimp's API infrastructure. The vulnerability is network-accessible, requires no authentication or user interaction, and can result in significant confidentiality, integrity, and availability impacts.

Root Cause

The root cause is classified as CWE-306: Missing Authentication for Critical Function. The REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe was implemented without any authentication checks or permission callbacks, exposing a sensitive API integration feature to public access.

Additionally, insufficient input validation on the list parameter and other request parameters allows attackers to craft malicious requests that are forwarded to Mailchimp's API. The plugin essentially acts as a blind proxy, accepting external API credentials and forwarding requests without validating the legitimacy of the request source.

Attack Vector

The attack vector is network-based, allowing remote exploitation from any unauthenticated source. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable REST endpoint on any WordPress site running an affected version of ElementsKit.

The exploitation process involves sending POST requests to the vulnerable endpoint with attacker-controlled Mailchimp API credentials and manipulated parameters. The affected WordPress site then forwards these requests to Mailchimp's API, effectively serving as an open proxy.

This can result in:

• Unauthorized manipulation of third-party Mailchimp accounts
• API quota exhaustion attacks against legitimate Mailchimp users
• Resource consumption on the WordPress server through repeated proxy requests
• Potential data manipulation of Mailchimp subscription lists

Since no code examples were verified for this vulnerability, administrators should consult the VulnCheck Security Advisory for technical implementation details.

Detection Methods for CVE-2026-23693

Indicators of Compromise

• Unusual volume of POST requests to /wp-json/elementskit/v1/widget/mailchimp/subscribe
• Access logs showing requests to the Mailchimp subscription endpoint from unexpected or anonymous sources
• Unexplained spikes in outbound traffic to Mailchimp API servers
• Server resource consumption anomalies correlated with REST API requests

Detection Strategies

• Monitor web server access logs for unauthenticated requests to the vulnerable endpoint path
• Implement web application firewall (WAF) rules to detect and alert on suspicious patterns targeting ElementsKit REST endpoints
• Review WordPress REST API access patterns for anomalous activity
• Deploy endpoint detection solutions capable of monitoring WordPress plugin behavior

Monitoring Recommendations

• Configure alerting for high-frequency requests to ElementsKit REST endpoints
• Implement rate limiting on the WordPress REST API to mitigate abuse
• Enable verbose logging for REST API requests during the remediation period
• Monitor outbound connections from the WordPress server to detect proxy abuse

How to Mitigate CVE-2026-23693

Immediate Actions Required

• Update ElementsKit Elementor Addons plugin to version 3.7.9 or later immediately
• If immediate patching is not possible, temporarily disable the ElementsKit plugin
• Review access logs for evidence of prior exploitation
• Consider implementing a WAF rule to block requests to the vulnerable endpoint until patching is complete

Patch Information

The vulnerability has been addressed in ElementsKit Elementor Addons version 3.7.9. Plugin updates can be obtained through the WordPress Plugin Directory or the WPMet official site. Administrators should verify the installed version and apply the update through the WordPress admin dashboard.

Workarounds

• Temporarily disable the ElementsKit plugin if immediate updating is not feasible
• Implement server-level access controls to block unauthenticated requests to /wp-json/elementskit/v1/widget/mailchimp/subscribe
• Deploy WAF rules to filter requests containing suspicious Mailchimp API patterns
• Restrict REST API access to authenticated users only as a temporary measure

# Apache .htaccess workaround to block the vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/elementskit/v1/widget/mailchimp/subscribe [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>