CVE-2026-92436: Mailchimp for WooCommerce Info Leak Flaw

CVE-2026-92436 Overview

CVE-2026-92436 is an information disclosure vulnerability in the Mailchimp for WooCommerce WordPress plugin before version 6.3. The plugin loads a saved cart based on a request-supplied identifier derived from a customer's email address without requiring authentication or verifying ownership. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read the saved cart contents. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can enumerate customers and read saved shopping cart data by supplying a predictable identifier derived from an email address.

Affected Products

Mailchimp for WooCommerce WordPress plugin versions prior to 6.3
WooCommerce storefronts using the affected plugin
WordPress sites with the plugin installed and active

Discovery Timeline

2026-09-27 - CVE-2026-92436 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-92436

Vulnerability Analysis

The Mailchimp for WooCommerce plugin maintains saved cart records tied to customer email addresses. When loading a saved cart, the plugin accepts an identifier supplied in the request and returns the matching cart. The server does not require the requester to authenticate as the cart owner. It also does not verify that the session or user has rights to the referenced resource.

Because the identifier is derived from the customer email address, an attacker who guesses or already possesses an email can construct a valid lookup value. The response discloses whether that customer exists in the store and returns the stored cart contents. This exposes shopping history and may reveal product preferences, quantities, and timing data useful for targeted phishing.

Root Cause

The root cause is a missing authorization check on a resource keyed by a user-controlled, predictable identifier. Classified as [CWE-639], the plugin trusts the request-supplied key instead of binding the saved cart to an authenticated session or a secret, unguessable token.

Attack Vector

Exploitation requires only network access to the storefront and knowledge of a target email address. The attacker issues an HTTP request to the saved cart loading endpoint with an identifier derived from the target email. The server responds with the saved cart if one exists, or a distinguishable response if it does not. No user interaction, authentication, or elevated privileges are needed. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-92436

Indicators of Compromise

Repeated requests to Mailchimp for WooCommerce saved cart endpoints with varying cart identifier parameters from a single source IP
Unauthenticated HTTP GET requests referencing cart identifiers that correlate to hashed or encoded email addresses
Elevated 200-response rates against saved cart endpoints without corresponding authenticated session cookies

Detection Strategies

Review web server access logs for enumeration patterns against plugin endpoints that handle saved cart retrieval
Correlate request bursts targeting cart identifier parameters with unknown or external referrers
Alert on anomalous access volumes to WooCommerce plugin paths that lack an authenticated WordPress session

Monitoring Recommendations

Enable verbose logging on the WordPress site and WooCommerce plugin endpoints
Deploy a web application firewall rule that rate-limits unauthenticated requests to cart-related plugin routes
Monitor outbound email abuse reports from customers that could indicate phishing based on leaked cart data

How to Mitigate CVE-2026-92436

Immediate Actions Required

Update the Mailchimp for WooCommerce plugin to version 6.3 or later on all WordPress installations
Audit saved cart data retention and purge stale records that are not required for business operations
Review web server and WAF logs for enumeration attempts against saved cart endpoints before applying the patch

Patch Information

Upgrade the Mailchimp for WooCommerce plugin to version 6.3 or later. The vendor fix removes the ability to load a saved cart using only a request-supplied identifier derived from the customer email. Verify the installed plugin version through the WordPress admin interface after update. Consult the WPScan Vulnerability Report for additional advisory information.

Workarounds

Disable the Mailchimp for WooCommerce plugin until the update to 6.3 can be applied
Restrict access to saved cart endpoints at the web server or WAF layer, requiring an authenticated WordPress session
Apply rate limiting on unauthenticated requests to WooCommerce plugin endpoints to slow enumeration attempts

bash

# Example WP-CLI command to update the plugin
wp plugin update mailchimp-for-woocommerce --version=6.3
wp plugin get mailchimp-for-woocommerce --field=version