CVE-2026-8151: 
WordPress vulnerability analysis and mitigation

CVE-2026-8151 is a Cross-Site Request Forgery (CSRF) vulnerability in the Simple Membership MailChimp Integration WordPress plugin that allows unauthenticated attackers to trick a logged-in administrator into replacing the configured MailChimp API key with an attacker-controlled one. All versions before 1.9.8 are affected. Once the API key is replaced, all subsequent member registration data — including name, email, and membership level — is silently exfiltrated to the attacker's MailChimp account. It carries a CVSS v3.1 base score of 5.4 (Medium) (WPScan, GitHub Advisory).

The vulnerability (CWE-352) stems from the absence of CSRF token validation in the plugin's settings page (swpm-mailchimp-admin-menu.php, line 12). Because the settings form does not verify the origin of the request, an attacker can craft a malicious HTML page containing a hidden auto-submitting form that targets the WordPress admin endpoint responsible for saving the swpm_mailchimp_settings option. No privileges are required on the attacker's side; only the victim administrator needs to be authenticated and visit the attacker-controlled page (WPScan, GitHub Advisory).

Successful exploitation allows an attacker to silently redirect all future member registration data — including first name, last name, email address, and membership level — to an attacker-controlled MailChimp account, resulting in ongoing data exfiltration without any visible disruption to site functionality. The confidentiality impact is low-to-moderate (member PII is exposed), and integrity is impacted through unauthorized modification of plugin settings. Availability is not affected, and the scope is limited to the plugin's data pipeline (WPScan, GitHub Advisory).

A public proof-of-concept (PoC) is documented in the WPScan advisory, consisting of a simple HTML form that auto-submits to the WordPress admin settings endpoint. However, there is no evidence of active in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "poc" and the attack as non-automatable due to the required user interaction. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using both the Simple Membership and Simple Membership MailChimp Integration plugins (versions before 1.9.8) via passive scanning or plugin enumeration.
2. Craft malicious page: Create an HTML page hosted on an attacker-controlled server containing a hidden form that POSTs to the target site's WordPress admin settings endpoint, setting mc_api_key to the attacker's MailChimp API key:

<form action="https://target-site.com/wp-admin/options.php" method="POST">
  <input type="hidden" name="option_page" value="swpm_mailchimp_settings" />
  <input type="hidden" name="mc_api_key" value="ATTACKER_MAILCHIMP_API_KEY_HERE" />
</form>
<script>document.forms[0].submit();</script>

3. Social engineering: Trick a logged-in WordPress administrator into visiting the attacker-controlled page (e.g., via phishing email, malicious link in a forum, or comment).
4. CSRF triggers: The form auto-submits upon page load, updating the swpm_mailchimp_settings WordPress option with the attacker's API key — no further interaction required.
5. Data harvesting: All subsequent member registrations on the target site (name, email, membership level) are now sent to the attacker's MailChimp account, enabling ongoing passive data collection (WPScan).

• Logs: WordPress admin action logs showing an unexpected update to the swpm_mailchimp_settings option, particularly from an unusual IP address or at an unusual time; HTTP POST requests to wp-admin/options.php with option_page=swpm_mailchimp_settings from an external referrer.
• Database: The wp_options table entry for swpm_mailchimp_settings containing an unrecognized or changed mc_api_key value not matching the organization's known MailChimp account.
• Network: Outbound member registration data being transmitted to an unrecognized MailChimp API endpoint or account; MailChimp account activity showing new list subscribers from the WordPress site that do not appear in the organization's own MailChimp dashboard.

Update the Simple Membership MailChimp Integration plugin to version 1.9.8 or later, which introduces CSRF token validation on the settings page (WPScan). As an interim measure, administrators should verify the current mc_api_key value in the plugin settings and confirm it matches their legitimate MailChimp account. Additionally, deploying a Web Application Firewall (WAF) with CSRF protection rules and educating administrators about phishing and social engineering risks can reduce exposure while patching is pending.

The vulnerability was discovered and reported by researcher Mustafa Ahmed of Fortress MSSP and verified by WPScan (WPScan). No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database publications.