CVE-2026-73346
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
Risk Assessment
An administrator can exploit the vulnerability to execute unauthorized database queries, potentially leading to data integrity breaches or privilege escalation.
Recommendation
Update the MailChimp For WooCommerce plugin to version 6.2 or later, which includes the fix.
Other vulnerabilities in MailChimp For WooCommerce
See all- CVE-2026-92436Medium
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier derived from a customer's email address. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read that customer's saved cart contents.
- CVE-2026-92435Medium
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes. This allows unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
Original NVD description (English source)
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS