ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Roxnor |
|
| Wordpress |
|
No data.
No data.
References
History
Wed, 25 Feb 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 24 Feb 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ElementsKit Lite (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site. | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site. |
| Title | ElementsKit Lite < 3.7.9 Unauthenticated Mailchimp REST Endpoint | ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint |
Tue, 24 Feb 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Roxnor
Roxnor elementskit Lite Wordpress Wordpress wordpress |
|
| Vendors & Products |
Roxnor
Roxnor elementskit Lite Wordpress Wordpress wordpress |
Mon, 23 Feb 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ElementsKit Lite (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site. | |
| Title | ElementsKit Lite < 3.7.9 Unauthenticated Mailchimp REST Endpoint | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-02-23T20:33:55.075Z
Updated: 2026-02-25T15:10:22.725Z
Reserved: 2026-01-14T20:09:32.352Z
Link: CVE-2026-23693
Vulnrichment
Updated: 2026-02-25T15:10:15.231Z
NVD
Status : Awaiting Analysis
Published: 2026-02-23T21:19:10.157
Modified: 2026-02-24T19:21:41.843
Link: CVE-2026-23693
Redhat
No data.