The Mailchimp List Subscribe Form plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper nonce validation in the mailchimp_sf_change_list_if_necessary() function. This allows attackers to forge requests that can modify Mailchimp lists if a site administrator is tricked into executing the action. The vulnerability affects all versions up to and including 2.0.0. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low complexity, no privileges required, but requiring user interaction. No known exploits are reported in the wild, and no patch or remediation details are currently available.

An attacker can cause a site administrator to unknowingly change Mailchimp lists via forged requests, potentially altering subscription lists without authorization. The impact is limited to integrity (I:L) with no confidentiality or availability impact. The vulnerability requires user interaction and does not require privileges, making it a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links from untrusted sources and consider implementing additional CSRF protections or monitoring for suspicious changes to Mailchimp lists.