The MC4WP: Mailchimp for WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in all versions up to and including 4.11.1. The plugin accepts the _mc4wp_action POST parameter without validating whether the requester is authorized to perform the action. As a result, unauthenticated attackers can manipulate this parameter to trigger unsubscribe actions arbitrarily. Since the form ID required to exploit this is publicly exposed in the HTML source, attackers can unsubscribe any email address from the Mailchimp audience linked to the plugin. This vulnerability has a CVSS 3.1 base score of 6.5, reflecting medium severity with network attack vector, no privileges required, and no user interaction needed.

An attacker can cause integrity and availability impacts by unsubscribing arbitrary email addresses from the Mailchimp audience without authentication. There is no confidentiality impact reported. This could disrupt legitimate mailing list subscriptions and affect communication with subscribers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to the form or implementing additional authorization checks to prevent unauthorized unsubscribe actions.