Is Mailchimp for WooCommerce safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (6.3). As of 2026-11-04. 6 issues are on record for older versions; version 6.3 or newer fixes all of them that state a fix. Keep Mailchimp for WooCommerce on the latest version (6.3) and remove it if you do not use it.

Which versions of Mailchimp for WooCommerce are vulnerable?

Known issues on record (newest first): Missing authorization check (older than 6.3, fixed in 6.3); Missing authorization check (older than 6.1.1, fixed in 6.1.1); SQL injection (older than 6.2, fixed in 6.2); Server-side request forgery (SSRF) (older than 2.7.1, fixed in 2.7.1); Server-side request forgery (SSRF) (older than 2.7.2, fixed in 2.7.2). The full list with sources is on this page.

What is the latest version of Mailchimp for WooCommerce?

6.3, according to wordpress.org (last updated 2026-09-23). It has 200,000+ active installs.

What should I do if my Mailchimp for WooCommerce is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update mailchimp-for-woocommerce). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · mailchimp-for-woocommerce · data as of 2026-11-04

Is Mailchimp for WooCommerce safe? Known vulnerabilities and latest version

Latest version: 6.3
Last updated: 2026-09-23
Active installs: 200,000+
Known issues on record: 6
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.4+

Connect your store to your Mailchimp audience to track sales, create targeted emails, send abandoned cart emails, and more. — by Mailchimp

What to do

Update to the latest version (6.3). Anything older than 6.3 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get mailchimp-for-woocommerce --field=version shows what you run; wp plugin update mailchimp-for-woocommerce updates it.

Check your version

Known vulnerabilities

6 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 5.3 CVE-2026-92437 · published 2026-10-03

Missing authorization check in Mailchimp for WooCommerce (older than 6.3)

Affected: older than 6.3
Fixed in: 6.3
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.

NVD CVE-2026-92437 WPScan advisory

medium 5.3 CVE-2026-92436 · published 2026-09-27

Missing authorization check in Mailchimp for WooCommerce (older than 6.3)

Affected: older than 6.3
Fixed in: 6.3
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.

NVD CVE-2026-92436 WPScan advisory

medium 5.3 CVE-2026-92435 · published 2026-09-19

Missing authorization check in Mailchimp for WooCommerce (older than 6.1.1)

Affected: older than 6.1.1
Fixed in: 6.1.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

NVD CVE-2026-92435 WPScan advisory

high 7.6 CVE-2026-73346 · published 2026-08-13

SQL injection in Mailchimp for WooCommerce (older than 6.2)

Affected: older than 6.2
Fixed in: 6.2
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

NVD CVE-2026-73346 Patchstack advisory

medium 4.3 CVE-2022-2267 · published 2022-08-29

Server-side request forgery (SSRF) in Mailchimp for WooCommerce (older than 2.7.1)

Affected: older than 2.7.1
Fixed in: 2.7.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: NVD analysis · score by NVD

Details from the advisory

The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example

NVD CVE-2022-2267 WPScan advisory

low 2.7 CVE-2022-2556 · published 2022-08-29

Server-side request forgery (SSRF) in Mailchimp for WooCommerce (older than 2.7.2)

Affected: older than 2.7.2
Fixed in: 2.7.2
Access needed (per CVSS): Needs an admin-level account
Range from: NVD analysis · score by NVD

Details from the advisory

The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example

NVD CVE-2022-2556 WPScan advisory

Recent activity

2026-09-23 — latest release on wordpress.org (6.3).
2026-10-03 — Missing authorization check disclosed (CVE-2026-92437), fixed in 6.3.
2026-09-27 — Missing authorization check disclosed (CVE-2026-92436), fixed in 6.3.
2026-09-19 — Missing authorization check disclosed (CVE-2026-92435), fixed in 6.1.1.

Free. We check the CVE feeds every day and email you only when a new issue for Mailchimp for WooCommerce (mailchimp-for-woocommerce) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (3) · Server-side request forgery (SSRF) (2) · SQL injection (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/mailchimp-for-woocommerce (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/mailchimp-for-woocommerce"><img src="https://laskyr.com/plugins/mailchimp-for-woocommerce/badge.svg" alt="Mailchimp for WooCommerce vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Mailchimp for WooCommerce safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (6.3)

What to do

Check your version

Known vulnerabilities

Missing authorization check in Mailchimp for WooCommerce (older than 6.3)

Missing authorization check in Mailchimp for WooCommerce (older than 6.3)

Missing authorization check in Mailchimp for WooCommerce (older than 6.1.1)

SQL injection in Mailchimp for WooCommerce (older than 6.2)

Server-side request forgery (SSRF) in Mailchimp for WooCommerce (older than 2.7.1)

Server-side request forgery (SSRF) in Mailchimp for WooCommerce (older than 2.7.2)

Recent activity

Get an email when Mailchimp for WooCommerce has a new vulnerability

Browse vulnerabilities

Where this data comes from