CVE-2023-40203 is a medium severity (CVSS 4.3) missing authorization flaw in the MailChimp Forms by MailMunch WordPress plugin, up to and including version 3.1.4. Patchstack lists 3.1.5 as the patched version. Update the plugin or remove it.
What's affected
The record names the WordPress plugin MailChimp Forms by MailMunch, versions up to and including 3.1.4. It scores the flaw 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
The weakness is CWE-862 (missing authorization). In practice that means a function in the plugin does not check whether the person calling it is allowed to. The NVD text says it allows exploiting incorrectly configured access control security levels. The record's vector needs no privileges but does need a user action, with a low impact on availability.
Patchstack vulnerability database entry lists 3.1.5 as the patched version and rates its own priority as low.
How to check if you're exposed
If you have shell access to the site, WP-CLI will show the installed version and whether an update is waiting:
wp plugin list --fields=name,status,version,update
wp plugin get mailchimp-forms-by-mailmunch --fields=name,version,update_version
Without WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name. Anything at or below 3.1.4 is affected. Multisite owners should check each site and the network, because a plugin can be active on only some of them.
If you run many sites, collect the plugin list from each one and look for this plugin by its folder name, mailchimp-forms-by-mailmunch. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.
What to do now
- Find every site that has MailChimp Forms by MailMunch installed, active or not. A deactivated plugin still sits on disk.
- Update to 3.1.5 or later from the Plugins screen, or with
wp plugin update mailchimp-forms-by-mailmunch. - If the plugin is no longer used, delete it rather than leaving it deactivated.
- Check which user roles can sign in to the site, and remove accounts that no longer need access.
- Turn on automatic updates for plugins you rely on, and keep a short list of what is installed on each site.
Why it matters
Missing authorization is the plainest kind of access control bug. The code runs the action for anyone who asks, because nobody wrote the check. It is common in WordPress plugins that expose request handlers for forms and settings.
The risk here is modest. The record rates the effect as low availability impact and nothing on confidentiality or integrity, and Patchstack classes it as low priority. It is still worth the two minutes the update takes, because marketing plugins tend to stay installed long after the campaign ends.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this plugin's flaw serious?
The scores say it is minor. The record gives 4.3 with only a low availability impact. The reason to update is that it costs almost nothing and removes a standing weakness.
What if I do not use the plugin any more?
Delete it. A deactivated plugin is not running, but its files stay on the server, and old plugin files are easy to forget in the next audit.
Sources
Last reviewed: 19 October 2026.
