CVE-2026-23693

ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint

State: Published
Severity: 9.3 Critical
Published: Feb 23, 2026
Updated: Jul 14, 2026
Reserved: Jan 14, 2026

Description

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H	VulnCheck
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for ElementorRoxnor	before 3.7.9Affected

References

https://wordpress.org/plugins/elementskit-lite/productpatch
https://wpmet.com/plugin/elementskit/product
https://www.vulncheck.com/advisories/elementskit-lite-unauthenticated-mailchimp-rest-endpointthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.