CVE-2026-8151 | BDVDB-2026-367243 Detail

Description#

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-02Record published in the CVE List.