Mailchimp for WooCommerce

Mailchimp for WooCommerce has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 4.7, and the most serious one scores 4.9 out of 10. 2022 was the busiest year with 2 disclosures.

The most common weakness is Server-Side Request Forgery (SSRF), behind 2 of the records (67%). Other recurring categories include SQL Injection.

Every one of the 3 issues recorded for Mailchimp for WooCommerce has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by miguelxpn. Mailchimp for WooCommerce is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
4.7/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Mailchimp for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.9CVE-2026-73346

Mailchimp for WooCommerce < 6.2 - Authenticated (Administrator+) SQL Injection

Read the full analysis

Vulnerability Records

3 records
Mailchimp for WooCommerce banner
Latestv6.2

Mailchimp for WooCommerce

Mailchimp

Author

Mailchimp

4.0(725)
80/100
Last Updated
2026-08-07 (1mo ago)
Active Installs
200,000+
Downloads
24,013,318
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2016-10-06 (10y ago)
Requires Plugins
woocommerce

Join the 17 million customers who use Mailchimp, the world’s largest marketing automation platform, to develop their e-commerce marketing strategy. With the official Mailchimp for WooCommerce integration, your customers and their purchase data are automatically synced with your Mailchimp account, making it easy to send targeted campaigns, automatically follow up with customers post-purchase, recommend products, recover abandoned carts, and measure the ROI of your marketing efforts. And it’s completely free. What you can do with this plugin Sync to your Audience in Mailchimp with purchase data. Sync new subscribers to your Audience when they create an account and opt-in. Set up marketing automations to remind customers about items they left in their cart or viewed on your site, win back lapsed customers, and follow up post-purchase. (Now available for free accounts!) Showcase product recommendations. Track and segment customers based on purchase history and purchase frequency. View detailed data on your marketing performance in your Mailchimp Dashboard. Find new customers, connect with current ones, and drive them all to your website with Facebook and Instagram ads. Then, set up Google remarketing ads to turn your site visitors into shoppers. Automatically embed a pop-up form that converts your website visitors to subscribers. Add discount codes created in WooCommerce to your emails and automations with a Promo Code content block Create beautiful landing pages that make it easy to highlight your products, promote a sale or giveaway, and grow your audience. This plugin is WPML compatible Important Notes This plugin supports our most powerful API 3.0 features, and is intended for users who have not yet integrated their WooCommerce stores with Mailchimp. You can run this new integration at the same time as your current WooCommerce integration for Mailchimp. However, data from the older integration will display separately in subscriber profiles, and can’t be used with e-commerce features that require API 3.0. WordPress.com compatibility is limited to Business tier users only.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C