CVE-2026-7520 describes a missing authorization (CWE-862) vulnerability in the MailChimp Forms by MailMunch WordPress plugin. The vulnerability exists because the sign_in() and sign_up() AJAX handlers do not perform proper capability checks. As a result, any authenticated user with at least Subscriber-level privileges can submit attacker-controlled credentials to relink the site's MailMunch integration to an attacker-controlled account. This leads to the exfiltration of subscriber data captured by the plugin's forms and allows the attacker to control the forms and landing pages rendered on the site. The vulnerability affects all versions up to and including 3.2.7. No official patch or remediation level has been provided as of the publication date.

An attacker with Subscriber-level access can hijack the MailMunch integration by relinking it to their own account. This compromises the confidentiality and integrity of subscriber data collected through the plugin, as all data will be sent to the attacker. Additionally, the attacker can manipulate the forms and landing pages displayed on the site, potentially misleading users or conducting further attacks. The vulnerability does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious changes to the MailMunch integration settings. Consider disabling the plugin if possible to prevent exploitation.