Threats tagged 'ghsa-4r9j-p4gw-x3hm'

The Customer Engagement System WordPress plugin versions prior to 2.0.2 have a vulnerability where unauthenticated users can access the MailChimp interest-group lookup feature without proper restrictions or API key validation. This flaw allows attackers to cause the server to open connections to arbitrary internal hosts and ports and infer their reachability based on response timing.