CVE-2026-7520 describes a missing authorization (CWE-862) vulnerability in the MailChimp Forms by MailMunch WordPress plugin versions up to and including 3.2.7. The vulnerability arises because the AJAX handlers sign_in() and sign_up() lack proper capability checks. As a result, authenticated users with Subscriber-level privileges or above can submit attacker-controlled credentials to relink the MailMunch integration to an attacker-controlled account. This allows the attacker to receive all subscriber data captured by the plugin's forms and to serve forms and landing pages from their own MailMunch account on the compromised site.

An attacker with at least Subscriber-level access can hijack the MailMunch integration, causing all subscriber data collected by the plugin to be sent to the attacker. Additionally, the attacker can manipulate the forms and landing pages displayed on the site by serving content from their own MailMunch account. This results in a high confidentiality and integrity impact, as sensitive subscriber data is exposed and site content is controlled by the attacker. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious changes to the MailMunch integration settings. Avoid granting unnecessary privileges to low-level users.