CVE-2026-1303 is a missing authorization vulnerability (CWE-862) in the MailChimp Campaigns WordPress plugin by matthieuscarset. The vulnerability arises from the absence of capability checks on the mailchimp_campaigns_manager_disconnect_app function, which is hooked to an AJAX action of the same name. This allows authenticated users with minimal privileges (Subscriber-level and above) to disconnect the MailChimp synchronization app, potentially disrupting email campaign automation. The issue affects all versions up to and including 3.2.4. The CVSS 3.1 base score is 5.3, reflecting a medium severity impact primarily due to integrity loss without confidentiality or availability impact.

An attacker with authenticated access at Subscriber level or higher can disconnect the WordPress site from its MailChimp synchronization app. This disrupts automated email campaigns and marketing integrations, causing loss of marketing functionality and potential business impact. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized changes to MailChimp integration settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor or WordPress security channels for any forthcoming patches.