blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-23693

CRITICAL 9.3 CVSS 4.0
Published
February 23, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-306
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.

Affected WordPress components

  • ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Plugin · elementskit-lite
    Confirmed match Active
    Before 3.7.9
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor — Before 3.7.9

References

  • wordpress.org https://wordpress.org/plugins/elementskit-lite/
  • wpmet.com https://wpmet.com/plugin/elementskit/
  • www.vulncheck.com https://www.vulncheck.com/advisories/elementskit-lite-unauthenticated-mailchimp-rest-endpoint
  • nvd.nist.gov Official NVD record