CVE-2025-12172: 
WordPress vulnerability analysis and mitigation

CVE-2025-12172 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mailchimp List Subscribe Form plugin for WordPress. It affects all versions up to and including 2.0.0, allowing unauthenticated attackers to change Mailchimp subscription lists by tricking a site administrator into clicking a malicious link. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is missing or incorrect nonce validation on the mailchimp_sf_change_list_if_necessary() function within the plugin, classified as CWE-352 (Cross-Site Request Forgery). An attacker crafts a forged HTTP request targeting this function and socially engineers a logged-in WordPress administrator into triggering it — for example, by clicking a malicious link in an email or on a webpage. Because the function does not verify the authenticity of the request via a nonce, the server processes the forged action as legitimate. No authentication is required on the attacker's side; only the victim's authenticated session is needed (Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to modify the Mailchimp mailing list associated with the WordPress site, potentially redirecting subscriber data to an attacker-controlled list or disrupting legitimate email marketing operations. The impact is limited to integrity — there is no direct confidentiality or availability impact — but manipulation of subscription lists could result in data misrouting, subscriber confusion, or reputational harm to the site owner (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12172. The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering of a site administrator, which raises the practical bar for attackers (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Mailchimp List Subscribe Form plugin version 2.0.0 or earlier, using tools like WPScan or passive enumeration of plugin assets.
2. Craft malicious request: Construct a forged HTTP GET or POST request targeting the vulnerable mailchimp_sf_change_list_if_necessary() function with attacker-chosen Mailchimp list parameters.
3. Deliver payload: Embed the forged request in a malicious link (e.g., via an <img> tag, <form> with auto-submit, or a direct URL) hosted on an attacker-controlled page or sent via email.
4. Social engineer the administrator: Trick a logged-in WordPress site administrator into visiting the malicious page or clicking the link — for example, through a phishing email or a comment on the site.
5. Achieve objective: The administrator's browser automatically sends the forged request with their authenticated session cookies, causing the plugin to switch the site's Mailchimp list to one specified by the attacker (Red Hat CVE).

• Logs: WordPress access logs showing unexpected POST or GET requests to admin-ajax.php or plugin-specific endpoints related to mailchimp_sf_change_list_if_necessary from unusual referrer URLs or external domains.
• Application: Unexpected changes to the configured Mailchimp list ID in the plugin's WordPress settings (wp_options table, option name related to Mailchimp SF).
• Network: Outbound connections from the WordPress server to Mailchimp API endpoints shortly after an administrator session, initiated by a request with an external or suspicious referrer header.

Users should update the Mailchimp List Subscribe Form plugin to a version beyond 2.0.0 that includes proper nonce validation. Until a patched version is available or applied, administrators should exercise caution when clicking links from untrusted sources while logged into WordPress, and consider temporarily deactivating the plugin if it is not actively needed. Implementing a Web Application Firewall (WAF) with CSRF protection rules can provide an additional layer of defense (Red Hat CVE).

Coverage of CVE-2025-12172 has been limited to vulnerability aggregation and tracking platforms. A brief technical summary was published by Infinitsec shortly after disclosure (Infinitsec). No significant vendor statements, notable researcher commentary, or broad media coverage has been identified for this vulnerability.