Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo Security & Risk Analysis

The plugin "contact-form-7-mailchimp-extension" v0.9.76 exhibits a mixed security posture. While the static analysis shows a strong adherence to secure coding practices, with a high percentage of SQL queries using prepared statements and output properly escaped, and no critical or high-severity taint flows detected, its vulnerability history raises significant concerns. The plugin has a history of three medium-severity CVEs, including exposure of sensitive information, CSRF, and SSRF. The fact that the last reported vulnerability was in 2025 suggests potential for ongoing or recurring security issues, despite the current lack of unpatched vulnerabilities.

The attack surface is minimal with no identified AJAX handlers, REST API routes, or shortcodes exposed without authentication. However, the presence of 9 cron events warrants attention, as these can sometimes be overlooked in security audits and potentially exploited. The plugin also performs file operations and external HTTP requests, which are common vectors for vulnerabilities if not handled with extreme care. While the current analysis doesn't reveal immediate exploitable flaws in the provided data, the historical pattern of medium-severity vulnerabilities and the nature of those vulnerabilities (SSRF, information exposure) suggest a need for continued vigilance and thorough auditing of any future updates.