Critical severity · published Feb 23, 2026
CVE-2026-23693
ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
10.0
CVSS
1.2%
EPSS
No
On KEV
Description
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor · Roxnor
before 3.7.9 · source: vendor
Affected product
EE
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Roxnor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23693
wordpress.org
https://wordpress.org/plugins/elementskit-lite/
wpmet.com
https://wpmet.com/plugin/elementskit/
www.vulncheck.com
https://www.vulncheck.com/advisories/elementskit-lite-unauthenticated-mailchimp-rest-endpoint
More from ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
8.8
CVE-2024-3499
ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module
8.8
CVE-2024-2047
ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw
6.5
CVE-2026-4362
ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
6.4
CVE-2026-2600
ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
5.4
CVE-2025-3614
ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget