What the vulnerability does
01Description
The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.2.4. This is due to missing capability checks on the `mailchimp_campaigns_manager_disconnect_app` function that is hooked to the AJAX action of the same name. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from its MailChimp synchronization app, disrupting automated email campaigns and marketing integrations.
Explanation of Vulnerability in Simple Terms
02Summary
MailChimp Campaigns versions 3.2.4 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify campaign data over the network. The vulnerability does not expose sensitive information or disrupt service availability, but attackers can alter campaign content or settings without permission. Update to a version newer than 3.2.4 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify campaign data without authentication or permission.
Potential impact on your site
04Site Impact
Campaigns can be altered or corrupted by unauthorized parties, potentially affecting email marketing integrity.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
