CVE-2026-8151: Unknown Simple Membership Mailchimp Integration

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

Affected products

• Unknown Simple Membership Mailchimp Integration: before 1.9.8 (fixed in 1.9.8)

Published 2026-09-02. Last modified 2026-09-03.