# CVE-2026-92436: Mailchimp for WooCommerce IDOR in saved cart loading

Source: https://junglewise.ai/threats/cve-2026-92436-the-mailchimp-for-woocommerce-wordpress-plugin-before-6-3-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-92436 · Severity: info · Published 2026-09-27

The Mailchimp for WooCommerce WordPress plugin fails to authenticate requests before loading customer saved carts, allowing an attacker with knowledge of a customer's email address to view that customer's shopping cart contents. An attacker can exploit this to confirm whether specific email addresses are customers of a store and to harvest details about their shopping behavior and saved items.

Technologies: [Mailchimp for WooCommerce](https://junglewise.ai/threats/technologies/mailchimp-for-woocommerce). Vendors: [Mailchimp](https://junglewise.ai/threats/vendors/mailchimp).

## Quick answers

**Is CVE-2026-92436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92436 being exploited in the wild.

**How severe is CVE-2026-92436?** Informational severity, published 27 September 2026.

**Which products and versions are affected?** Mailchimp for WooCommerce before 6.3.

**Is there a fix for CVE-2026-92436?** A patch was published on 2026-09-27: Version 6.3 includes fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92436 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92436?** Check whether you run Mailchimp for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin derives a cart identifier from a customer's email address and loads the saved cart without verifying authentication or ownership, creating an IDOR (Insecure Direct Object Reference) vulnerability. An unauthenticated network attacker who knows a customer's email can request that identifier and read the cart contents. This affects versions before 6.3, which added proper access controls.

## Affected products

- Mailchimp Mailchimp for WooCommerce before 6.3

## Timeline

- 2026-09-25: disclosed
- 2026-09-27: patched: Version 6.3 includes fix

## References

- [https://wpscan.com/vulnerability/f4d7b94a-7699-464c-a646-5946837b363a/](https://wpscan.com/vulnerability/f4d7b94a-7699-464c-a646-5946837b363a/)

## Related threats

- [Mailchimp for WooCommerce unauthenticated abandoned cart modification](https://junglewise.ai/threats/cve-2026-92437-the-mailchimp-for-woocommerce-wordpress-plugin-before-6-3-does)
- [Mailchimp for WooCommerce missing authorization in REST API](https://junglewise.ai/threats/cve-2026-92435-the-mailchimp-for-woocommerce-wordpress-plugin-before-6-1-1-does)