The impact of this vulnerability is significant, as it effectively grants the attacker control over the data pipeline. Once the integration is hijacked, any personal identifiable information (PII) captured through the plugin's forms is sent directly to the attacker's external account. Furthermore, the attacker can force the WordPress site to render malicious forms or landing pages hosted within their own MailMunch environment, potentially facilitating further phishing or credential harvesting campaigns against site visitors.

Attack Chain

1. Attacker obtains valid low-privileged credentials (Subscriber level) on the target WordPress site via brute force or credential stuffing.
2. Attacker logs into the WordPress site to establish an authenticated session.
3. Attacker identifies the WordPress site is using the 'MailChimp Forms by MailMunch' plugin.
4. Attacker performs an HTTP POST request to the admin-ajax.php endpoint associated with the sign_in() or sign_up() plugin functions.
5. The server fails to validate the user's role/capability, allowing the request to proceed.
6. The plugin updates its internal database configuration with the attacker's provided API keys or credentials.
7. Captured form data from legitimate site visitors is redirected to the attacker's exfiltration point.
8. Attacker leverages the compromised plugin interface to inject malicious landing pages for social engineering.

Impact

Successful exploitation results in the unauthorized exfiltration of all subscriber PII collected via the plugin's forms and the potential delivery of malicious content to end-users. The plugin is widely used in small-to-medium enterprise (SME) websites; the scale of potential impact spans any site using the vulnerable 3.2.7 or earlier versions. Data theft can lead to direct regulatory compliance violations and reputational damage.

Recommendation

Prioritized actions for security teams:

• Update the 'MailChimp Forms by MailMunch' plugin to the latest version immediately to remediate the missing capability checks.
• Audit WordPress user accounts for suspicious 'Subscriber' or lower-privileged account creation dates to identify potential initial access.
• Review web server access logs for anomalous POST requests to wp-admin/admin-ajax.php involving the MailMunch plugin strings.
• Ensure administrative access to the WordPress dashboard is protected by Multi-Factor Authentication (MFA) to prevent unauthorized entry of low-privileged accounts.