---
id: CVE-2025-10735
title: >-
  The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress
  is vulnerable to Blind Server-Side Request Forgery in all versions up to, and
  including, 1.1.12 via the mcbSubmit_Form_Data()
summary: >-
  The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress
  is vulnerable to Blind Server-Side Request Forgery in all versions up to, and
  including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for
  unau…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-918
published: '2025-10-01'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T09:10:00.213'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10735'
references:
  - url: >-
      https://plugins.svn.wordpress.org/block-for-mailchimp/tags/1.1.9/mailchimp/API.php
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368808%40block-for-mailchimp&new=3368808%40block-for-mailchimp&sfp_email=&sfph_mail=
    label: security@wordfence.com
  - url: 'https://wordpress.org/plugins/block-for-mailchimp/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00305
epssPercentile: 0.23149
ingestedAt: '2026-10-01T18:55:42.293Z'
---

## Overview

The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.