CVE-2026-92437: Unknown Mailchimp For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.

Affected products

• Unknown Mailchimp For Woocommerce: before 6.3 (fixed in 6.3)

Published 2026-10-03. Last modified 2026-10-06.