CVE-2026-7520

Executive Summary

CVE-2026-7520 is a Missing Authorization vulnerability (CWE-862) affecting the MailChimp Forms by MailMunch WordPress plugin, versions 3.2.7 and earlier. The flaw resides in the sign_in() AJAX handler, which lacks a capability check, allowing any authenticated user with Subscriber-level access to re-link the victim site's MailMunch integration to an attacker-controlled account. Successful exploitation results in complete theft of subscriber data captured by the plugin's forms, as well as replacement of legitimate forms and landing pages with attacker-controlled content, earning the vulnerability a CVSS score of 8.1 (High) with High confidentiality and integrity impact.

While there is no CISA KEV listing and no confirmed in-the-wild exploitation, the vulnerability is technically trivial to exploit—requiring only a valid WordPress account with Subscriber privileges—and public proof-of-concept code has been released. WordPress sites running the plugin should treat this as a high-priority remediation target.

Technical Analysis

The MailChimp Forms by MailMunch plugin (formerly "MailMunch") provides WordPress administrators with tools to create opt-in forms, landing pages, and integrate captured subscriber data with MailChimp. The plugin relies on a cloud-based MailMunch account (via mailmunch.co) to store form templates, collect subscriber lists, and render forms on the frontend. The site-to-account binding is established during plugin setup, typically via an email/password authentication flow that returns an API token stored in the WordPress options table.

The vulnerability exists in the plugin's AJAX endpoints. WordPress AJAX actions registered by the plugin include sign_in and sign_up, which are intended to allow the plugin itself to authenticate the site administrator against the MailMunch cloud service. Critical to this flaw, these actions are registered using wp_ajax_ hooks (for authenticated users) without an accompanying wp_ajax_nopriv_ hook (for unauthenticated users), but the handler functions never perform a current_user_can() or check_ajax_referer() capability check for administrative privileges. Only a valid WordPress nonce and an active session are required.

The vulnerable code path, presented in simplified form:

add_action('wp_ajax_sign_in', 'mailmunch_sign_in');
add_action('wp_ajax_sign_up', 'mailmunch_sign_up');

function mailmunch_sign_in() {
    check_ajax_referer('mailmunch', 'security'); // nonce check only — no capability check
    $email = sanitize_email($_POST['email']);
    $password = $_POST['password'];
    // Send credentials to MailMunch API, receive integration token on success
    // Store token in wp_options: 'mailmunch_api_token'
    // Update site_id option with attacker's MailMunch site ID
    wp_send_json_success();
}

The nonce is generated for any logged-in user on pages where the plugin outputs its JavaScript, meaning the attacker does not need to reverse-engineer nonce generation—they can simply load any page containing the plugin's forms while logged in and extract the nonce from the page source. Alternatively, the nonce is derivable from the user session, so a scripted attack using the WordPress REST API or direct AJAX POST can obtain it automatically.

Once the sign_in AJAX action is triggered with attacker-supplied MailMunch account credentials, the plugin:

1. Authenticates against MailMunch's OAuth/credential endpoint using the attacker's email/password.
2. Retrieves an API token bound to the attacker's MailMunch account.
3. Overwrites the stored integration token and site ID in wp_options.
4. From that point forward, all form submissions are POSTed to the attacker's MailMunch cloud account.
5. Frontend forms and landing pages are rendered from templates owned by the attacker, allowing display of arbitrary phishing content.

The attack surface is broad: any page on the WordPress site that the plugin loads JavaScript on will expose the AJAX action and nonce to logged-in users. The attack requires no special privileges beyond Subscriber, making it accessible to any registered user—including spammers who register via open registration or attackers who have compromised a legitimate low-privilege account.

Affected Endpoints

• AJAX Action: sign_in (and by extension sign_up)
• HTTP Method: POST with action=sign_in, security=[nonce], email=[attacker_email], password=[attacker_password]

Version Range

All versions up to and including 3.2.7. No patched version has been identified by any tracked source. The plugin's core functionality and authentication flow have remained largely unchanged across recent versions, suggesting the flaw may have existed since the plugin's inception.

Exploitation Scenarios

Attack Chain: Full MailMunch Integration Takeover

Step 1 — Reconnaissance & Target Identification

An attacker begins by identifying WordPress sites using the MailChimp Forms by MailMunch plugin. This is accomplished via:

• Plugin fingerprinting: Viewing page source for mailmunch script handles (e.g., //a.mailmunch.co/app/v1/site.js) or stylesheet references.
• Post/Page discovery: Searching for forms with distinctive MailMunch CSS classes (mailmunch-form, mailmunch-serving).
• Site enumeration: Using the WordPress REST API (/wp-json/) to check for exposed plugin data, or using public CSS/JS asset detection services (e.g., Wappalyzer, BuiltWith).
• Shodan/Censys: Searching for WordPress installations with the plugin's unique markers in HTTP response bodies.

Step 2 — Establish Authenticated Session

The attacker must possess a valid account with at least Subscriber role. Options:

• If WordPress user registration is enabled (Users → Settings → Anyone can register), the attacker registers a free account directly.
• If registration is closed, the attacker purchases a low-cost account from the site (membership site) or leverages a previously compromised Subscriber credential.
• If the attacker has compromised an administrator account, the attack is trivial but does not require such access—Subscriber is sufficient.

Once logged in, the attacker navigates to any page on the site that embeds the MailMunch forms. The plugin enqueues its JavaScript on all pages it is active on, outputting the following:

<script>
var munch = {action: 'sign_in', security: 'f3a9b2c1d8e7f6a5b4c3d2e1', ...};
</script>

The value of the security field is the nonce. The attacker extracts this nonce using a simple browser console read or automated script.

Step 3 — Execute the Exploit Payload

The attacker creates a MailMunch account at mailmunch.co (free tier) and uses its credentials to craft the AJAX POST. Using the WordPress AJAX endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim-site.com
Cookie: wordpress_logged_in_<HASH>=<session>
Content-Type: application/x-www-form-urlencoded

action=sign_in&security=f3a9b2c1d8e7f6a5b4c3d2e1&email=attacker%40evil.com&password=Sup3rS3cret%21

An alternative approach via cURL:

curl -b cookies.txt -X POST "https://victim-site.com/wp-admin/admin-ajax.php" \
  -d "action=sign_in&security=f3a9b2c1d8e7f6a5b4c3d2e1&email=attacker@evil.com&password=Sup3rS3cret!"

The server responds with the plugin's custom JSON payload. The plugin then stores the attacker's MailMunch integration token in the wp_options table under mailmunch_site_id and mailmunch_api_token. No second request or confirmation step is required—the takeover is immediate.

Step 4 — Post-Exploitation: Data Exfiltration & Phishing

With the integration re-linked:

• Subscriber data theft: All new form submissions (email addresses, names, custom fields) are sent from the victim's WordPress server to the attacker's MailMunch account dashboard. Depending on existing form configurations, historical subscriber data may also be synced on the next scheduled sync or pageload.
• Content injection: The attacker can edit forms and landing pages in their MailMunch dashboard. These changes propagate to the victim site in real-time (typically within seconds via JS polling). The attacker can:
  • Replace opt-in forms with phishing forms requesting additional PII (phone numbers, postal addresses, payment details).
  • Inject malicious JavaScript into form strings that execute in the context of the victim site's domain, enabling session hijacking, credential phishing, or drive-by malware delivery.
  • Redirect form submissions to attacker-controlled tracking endpoints.

Step 5 — Persistence & Cover-Up

The attacker maintains persistence by keeping the re-linked integration active. Even if the victim administrator notices suspicious forms, removing the plugin or re-authenticating requires admin-level action; a standard plugin deactivation/re-activation may not reset the stored API token, depending on the uninstall hooks. The attacker can also chain this CVE with other low-privilege plugin vulnerabilities to escalate to admin.

Lateral Consideration: Because the attacker now renders content on the victim's site from their cloud account, they can target site visitors—not just the site owner—with credential harvesting pages that mimic WordPress login, thereby compromising additional accounts and expanding the attack surface.

Impact Assessment

CVSS v3.1 Score: 8.1 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

• Attack Vector (AV:N): The vulnerability is exploitable via the WordPress AJAX endpoint over the network.
• Attack Complexity (AC:L): No specialized conditions are required; standard authentication and a valid nonce suffice.
• Privileges Required (PR:L): Subscriber-level access is the minimum requirement—the lowest authenticated privilege tier.
• User Interaction (UI:N): No victim interaction is needed; the attack runs automatically once the AJAX request is sent.
• Scope (S:U): The vulnerable component is confined to the plugin; however, the downstream impact extends to site visitors.
• Confidentiality Impact (C:H): Complete loss of subscriber data confidentiality. All form-captured PII is forwarded to the attacker.
• Integrity Impact (I:H): Complete compromise of on-site form content and rendered landing pages. Malicious content injection is possible.
• Availability Impact (A:N): No direct denial of service, though malicious content could cause functionality breakage.

Business Impact:

• Data Breach Liability: Subscriber lists are often covered under GDPR/CCPA and similar privacy regulations. Loss of this data may trigger mandatory breach notification requirements and regulatory fines.
• Brand & Trust Damage: Replacement of forms with malicious phishing content will be visible to all site visitors, severely undermining user trust and potentially leading to secondary compromises of customer accounts.
• GDPR Article 32 Violation: Failure to implement appropriate technical measures (the missing capability check) constitutes a security design flaw that regulators weigh heavily.
• Monetary Loss: Stolen subscriber lists are sold on underground markets; phishing campaigns resulting from injected forms can cause direct financial loss to victims.

Blast Radius: Any WordPress site using the plugin is affected. Given the plugin's popularity (estimated 10,000+ active installs based on typical WordPress plugin distribution), the potential victim pool is substantial. The recon-to-exploitation chain can be fully automated, meaning a single attacker can compromise thousands of sites in a campaign, forwarding all stolen data to a central collection point.

Detection Guidance

Sigma Rule

title: MailMunch Plugin sign_in AJAX Exploitation Attempt
id: 8f6a2c7d-9b3e-4f1a-a5d8-2c4b6e8d0f1a
status: experimental
description: Detects authenticated AJAX requests to the sign_in action targeting the MailChimp Forms by MailMunch plugin, indicating potential MailMunch integration takeover.
author: Valters IT Security Research
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method: 'POST'
      c-uri|contains: '/wp-admin/admin-ajax.php'
      cs-uri-query|contains: 'action=sign_in'
      c-useragent|contains|all:
        - 'WordPress'
        - 'Mozilla'
    condition: selection
  fields:
    - c-ip
    - cs-username
    - cs-uri-query
falsepositives:
  - Legitimate administrator re-authentication of the MailMunch plugin
  - Plugin setup/repair flows
level: medium

YARA Rule

rule WordPress_MailMunch_SignIn_Exploit
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects PHP code or strings associated with MailMunch sign_in AJAX handler missing authorization check"
        cve = "CVE-2026-7520"
        date = "2026-01-15"
        score = 80

    strings:
        $ajax_hook = "wp_ajax_sign_in"
        $handler_func = "function mailmunch_sign_in" ascii nocase
        $nonce_check = "check_ajax_referer" ascii nocase
        $api_token = "mailmunch_api_token" ascii nocase
        $site_id = "mailmunch_site_id" ascii nocase
        $curl_auth = "site_id=" ascii nocase

    condition:
        uint16(0) == 0x5A4D and filesize < 500KB and
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-7520 - MailMunch Plugin sign_in AJAX Exploitation Attempt";
    flow:established,to_server;
    http.method:"POST";
    http.uri:"/wp-admin/admin-ajax.php";
    http.request_body;
    content:"action=sign_in";
    nocase;
    pcre:"/email=[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}&password=/Ui";
    classtype:attempted-admin;
    sid:20267520;
    rev:1;
    metadata:created_at 2026_01_15, cve CVE-2026-7520, attack_target WordPress;
)

Elastic Detection

// Detect AJAX requests targeting MailMunch sign_in endpoint with unusual patterns
sequence by source.ip, user.name with maxspan=5m
  [authentication where event.action == "logon" and user.name != "*"]
  [http where request.method == "POST" and request.uri == "/wp-admin/admin-ajax.php"
   and url.query contains "action=sign_in"
   and request.body.text contains ("email=" and "password=")
   and not user.name in ("admin", "administrator")]

Splunk SPL Query

index=wineventlog OR index=web sourcetype=iis OR sourcetype=apache
| where like(cs_uri_query, "%action=sign_in%")
| search cs_uri="/wp-admin/admin-ajax.php"
| eval suspicious = if(match(cs_uri_query, "email=.*@.*&password="), "true", "false")
| search suspicious="true"
| stats count by src_ip, username, cs_uri_query, _time
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100301" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/wp-admin/admin-ajax\.php</field>
    <field name="method">POST</field>
    <regex>action=sign_in</regex>
    <description>MailMunch plugin sign_in AJAX exploit attempt (CVE-2026-7520)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>wordpress_vuln</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (confidence 0/4). No patched version has been released by the vendor. CVE-2026-7520 remains exploitable in all known versions of the plugin.

1. Immediate Mitigations (Do These Now)

• Disable the plugin entirely if forms are not business-critical. Navigate to Plugins → Installed Plugins and deactivate "MailChimp Forms by MailMunch." This is the only guaranteed way to eliminate the vulnerability.
• Disable WordPress user registration if not required: Settings → General → Membership → Anyone can register — uncheck this box. This prevents attackers from self-registering Subscriber accounts.
• Audit all existing user accounts with Subscriber or Contributor roles. Remove or escalate accounts that are inactive, have default passwords, or lack verified email addresses. Focus on accounts created in the last 6 months.
• Restrict access to admin-ajax.php at the WAF level for authenticated low-privilege requests, or use a WordPress security plugin to add capability checks for AJAX actions. A properly crafted .htaccess rule or WAF rule can block POST requests to /wp-admin/admin-ajax.php that contain action=sign_in from non-admin IP ranges.
• Implement a firewall rule (mod_security, Cloudflare WAF, AWS WAF) to block AJAX requests matching the Suricata rule pattern above.

2. Patch/Upgrade Steps

• Monitor vendor channels: The plugin author (MailMunch) has not released a patched version as of this report. Subscribe to the plugin's WordPress.org page and the Wordfence Vulnerability database for updates.
• Apply the theoretical patch manually if you are a developer: Locate the sign_in() and sign_up() functions in class-mailmunch-admin.php (or equivalent) and add a capability check immediately after the nonce verification:

  if (!current_user_can('manage_options')) {
      wp_die('Unauthorized', '', ['response' => 403]);
  }
  

  Save the change and test thoroughly. Note that this manual patching will be overwritten by plugin updates—reapply after each update until the vendor ships a fix.
• Watch for updates: Set up automated update notifications and apply the plugin update immediately when a patched version is released.

3. Long-Term Hardening

• Harden WordPress user roles: Use a role editor plugin to remove all capabilities from the Subscriber role except read. Subscribers should not be able to access any plugin management endpoints.
• Enable Two-Factor Authentication (2FA) for all users, including Subscribers, to reduce the risk of account takeover leading to this exploit.
• Review all plugin code for similar AJAX capability gaps: Use a WordPress security scanner (WPScan, WPSec) to identify other plugins with missing authorization checks.
• Implement continuous monitoring: Deploy a file integrity monitoring tool and a WAF that inspects AJAX requests for anomalies. Integrate the above detection rules into your SIEM/SOC workflows.
• Maintain a least-privilege policy: Review all third-party plugins annually. Remove plugins that lack an active maintenance status or have a history of vulnerabilities.
• Subscribe to threat intelligence feeds: Sign up for Wordfence, Patchstack, and CISA alerts for WordPress-related vulnerabilities. Ensure CVE-2026-7520 is tagged in your vulnerability management platform for automated alerting.

References

1. NVD Entry: CVE-2026-7520 — NVD Description and CVSS vector. https://nvd.nist.gov/vuln/detail/CVE-2026-7520
2. CNA/Wordfence Advisory: Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action in MailChimp Forms by MailMunch <= 3.2.7. https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2c5d7a-9f1b-4e3c-8a6d-2b5f0c9e7a1b
3. Email Now Attack Surface Research: "MailMunch Plugin Flaw Allows Subscriber-Level Account Takeover" — Public proof-of-concept writeup with step-by-step exploitation details and affected version analysis. https://www.exploit-db.com/exploits/52000
4. WordPress Plugin Repository: MailChimp Forms by MailMunch — Vendor page. Note: No version 3.2.8 or later is listed, consistent with unpatched status. https://wordpress.org/plugins/mailchimp-forms-by-mailmunch/
5. CISA Known Exploited Vulnerabilities Catalog: CVE-2026-7520 is NOT listed. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of this report, there is no confirmed exploitation in the wild or observed threat actor campaign targeting CVE-2026-7520. However, the EPSS score of 0.00270 sits at the 18.9th percentile of exploited CVEs, indicating a moderate probability of exploitation within the next 30 days given the trivial nature of the attack. Public exploit code is available, and the vulnerability is highly automatable; enterprise defenders should treat this as an imminent risk.