CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
- Published Sep 2, 2026
- CVSS 5.4 medium
- 0.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available