Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo

Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 4 issues recorded for Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-15000

Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values

Read the full analysis

Vulnerability Records

4 records
Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo banner
Latestv0.9.81.12

Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo

Renzo Johnson

Author

Renzo Johnson

4.2(191)
84/100
Last Updated
2026-09-03 (9d ago)
Active Installs
40,000+
Downloads
10,240,685
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2015-01-21 (12y ago)

A Mailchimp integration for Contact Form 7 that also connects forms to Brevo, MailerLite, and Klaviyo. Send form submissions to email marketing lists, audiences, or groups without replacing Contact Form 7 or adding a separate automation platform. Choose a provider for each form, connect the account, select a destination, and map Contact Form 7 fields to subscriber fields. Existing Mailchimp forms keep their saved audience, field mappings, credentials, and opt-in settings after upgrading. New to this? Start with the basic setup walkthrough, or read the 2026 guide to Contact Form 7 and Mailchimp automation. Contact Form 7 Email Marketing Integrations Choose one provider independently for each Contact Form 7 form. Each integration sends submitted subscriber data directly to the audience, list, or group selected in that form’s settings. Mailchimp integration for Contact Form 7 – Connect through one-click OAuth or an API key, choose an audience, map merge fields, and select single or double opt-in. Read the Mailchimp setup guide. Brevo integration for Contact Form 7 – Connect with a Brevo API key, choose a list, map contact attributes, and select direct subscription or a Brevo confirmation email. Read the Brevo setup guide. MailerLite integration for Contact Form 7 – Connect with a MailerLite API token, choose a group, and map subscriber fields. Double opt-in follows the MailerLite account setting. Read the MailerLite setup guide. Klaviyo integration for Contact Form 7 – Connect with a Klaviyo private API key, choose a list, and map profile properties. Confirmation behavior follows the selected Klaviyo list. Read the Klaviyo setup guide. Everything included Choose Mailchimp, Brevo, MailerLite, or Klaviyo independently for each Contact Form 7 form. Use different provider accounts and destinations on different forms. Load audiences, lists, or groups inside the Contact Form 7 editor. Map the required email address and up to four additional Contact Form 7 fields. Require an opt-in checkbox before subscriber data is sent. Control or respect provider-specific confirmation behavior. Keep existing Mailchimp configurations working after upgrading. Use unlimited Contact Form 7 forms. Built for Contact Form 7 ChimpMatic adds a focused integration panel to each Contact Form 7 form. It does not replace your forms, introduce another form builder, or require a generic automation service between WordPress and your email provider. Wondering how this compares to the alternatives? We set out the trade-offs in our Mailchimp plugin comparison and our marketing automation comparison. ChimpMatic Pro ChimpMatic Pro is an optional add-on for teams that need advanced provider features, expanded field mapping, advanced consent controls, subscriber tagging, and priority support. ChimpMatic Lite remains a complete Contact Form 7 integration on its own. Compare ChimpMatic Lite and Pro · Pricing · Installing Pro External Services and Data Disclosure ChimpMatic is independently developed and is not affiliated with or endorsed by Mailchimp, Brevo, MailerLite, or Klaviyo. When a configured form is submitted, its email address, mapped fields, destination, and consent choice are sent directly to the provider you selected; an account with that provider is required. Full detail is in our external services disclosure and privacy policy. Support Provider integration guides Documentation and Help Center Mailchimp integration FAQ Contact the ChimpMatic team

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C