Log in / Sign up

Vulnerability details

CVE-2026-23693

roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor

ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint

CVSS 4.0
9.3Critical

Official description

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.

CVSS scores

ScoreVersionSourceVector
9.3Critical 4.0 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
10.0Critical 3.1 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Affected products

VendorProductVersionsSource
roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor v < 3.7.9 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-02-24
Last updated
2026-07-14
State
Published
Assigner (CNA)
VulnCheck

Exploit prediction (EPSS)

1.25%
Probability of exploitation in 30 days
69.6%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-306
    Missing Authentication for Critical Function