CVE-2026-92435 Overview
CVE-2026-92435 is a missing authorization vulnerability in the Mailchimp for WooCommerce WordPress plugin in versions before 6.1.1. The plugin fails to verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. Unauthenticated attackers can reach administrator-oriented endpoints and trigger a persistent state change on the target site. The flaw is categorized as [CWE-862] Missing Authorization and is remotely exploitable over the network without user interaction. Site operators running WooCommerce stores with this plugin are exposed until they upgrade to the patched release.
Critical Impact
Unauthenticated remote attackers can invoke administrator-only REST API routes and modify plugin state on affected WooCommerce sites.
Affected Products
- Mailchimp for WooCommerce WordPress plugin versions prior to 6.1.1
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Any hosting environment exposing the WordPress REST API to the internet
Discovery Timeline
- 2026-09-19 - CVE-2026-92435 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-92435
Vulnerability Analysis
The vulnerability resides in the plugin's REST API implementation. WordPress REST API routes are registered with a permission_callback function that is expected to enforce capability checks before the endpoint handler runs. In versions before 6.1.1, several routes register callbacks that do not verify whether the caller holds the required administrator capability. As a result, requests from unauthenticated clients pass the permission gate and reach handlers intended solely for site administrators. The attacker can invoke these handlers to trigger a persistent state change within the plugin, affecting integrity of the plugin configuration. Confidentiality and availability are not directly impacted per the CVSS vector published for this issue.
Root Cause
The root cause is an improper authorization check [CWE-862] within the permission_callback handlers registered via register_rest_route(). Rather than validating the user's WordPress capability, for example using current_user_can( 'manage_options' ), the callbacks return a value that permits the request to proceed regardless of caller identity. This breaks the boundary between administrative and public REST endpoints.
Attack Vector
Exploitation requires only network access to the WordPress REST API surface exposed at /wp-json/. An attacker sends an HTTP request to the affected plugin routes without any authentication cookie or nonce. The handler processes the request and persists changes to plugin state. No user interaction, credentials, or elevated privileges are required. Refer to the WPScan Vulnerability Report for the specific routes and payload details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-92435
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-json/ routes registered by the Mailchimp for WooCommerce plugin, particularly requests originating from unfamiliar IP addresses.
- Unexpected modifications to Mailchimp for WooCommerce plugin settings in the WordPress options table without a corresponding administrator login event.
- REST API responses with HTTP 200 status codes to sensitive plugin routes from clients that never authenticated to wp-login.php.
Detection Strategies
- Enable WordPress REST API request logging and alert on requests to Mailchimp for WooCommerce endpoints that lack a valid X-WP-Nonce header or authenticated session cookie.
- Correlate plugin configuration changes with the WordPress user activity log to identify state changes with no attributable administrator action.
- Deploy web application firewall (WAF) rules that inspect requests to /wp-json/mailchimp-for-woocommerce/ paths and flag unauthenticated access.
Monitoring Recommendations
- Monitor outbound connections from the WordPress host to unexpected Mailchimp API destinations that may indicate attacker-controlled configuration.
- Track version metadata for installed WordPress plugins across the fleet and alert when Mailchimp for WooCommerce is below 6.1.1.
- Review WooCommerce audit trails and administrator email notifications for unsolicited plugin activity.
How to Mitigate CVE-2026-92435
Immediate Actions Required
- Update the Mailchimp for WooCommerce plugin to version 6.1.1 or later on all WordPress sites.
- Audit the plugin settings and REST API access logs for evidence of unauthorized changes since the plugin was installed.
- Rotate any Mailchimp API keys stored in the plugin configuration if unauthorized access is suspected.
Patch Information
The vendor addressed the missing authorization by adding proper capability checks in the affected permission_callback functions. Upgrade to Mailchimp for WooCommerce 6.1.1 or newer through the WordPress plugin manager or by deploying the updated package via WP-CLI. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to /wp-json/mailchimp-for-woocommerce/ REST routes at the reverse proxy or WAF layer until the update is applied.
- Temporarily deactivate the plugin on sites that cannot be patched immediately.
- Enforce IP allowlisting on the WordPress REST API for administrative operations where feasible.
# Update the plugin via WP-CLI
wp plugin update mailchimp-for-woocommerce --version=6.1.1
wp plugin list --name=mailchimp-for-woocommerce --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
