{
    "title": "MC4WP: Mailchimp for WordPress",
    "seo_title": "MC4WP Mailchimp for WordPress: review and settings",
    "h1": "MC4WP: Mailchimp for WordPress",
    "description": "MC4WP free or Premium: strengths, limitations, pricing, recommended double opt-in and integration settings, and patched vulnerabilities.",
    "lead": "MC4WP connects WordPress to Mailchimp: a sign-up form plus checkboxes in your comment, contact or checkout forms. Our take on the free and Premium versions, the consent settings to keep and the patched vulnerabilities worth knowing.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:15:40+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/mailchimp-for-wordpress/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "MC4WP: Mailchimp for WordPress",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/mailchimp-for-wordpress/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/mailchimp-for-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/mailchimp-for-wordpress/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "MC4WP: Mailchimp for WordPress"
        },
        {
            "level": 2,
            "text": "What MC4WP does on your site"
        },
        {
            "level": 2,
            "text": "Which sites MC4WP is a good fit for"
        },
        {
            "level": 2,
            "text": "MC4WP strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend for MC4WP"
        },
        {
            "level": 2,
            "text": "MC4WP security: medium-severity flaws, regular fixes"
        },
        {
            "level": 2,
            "text": "MC4WP frequently asked questions",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for blogs and stores whose mailing list is already managed in Mailchimp.\n- Main caveat: only one form in the free version, and the plugin works with Mailchimp only.\n- Free; Premium costs $59 a year for one site, with unlimited forms and WooCommerce tracking.\n\n## What MC4WP does on your site\n\nMC4WP: Mailchimp for WordPress connects your site to a Mailchimp account through an API key, then adds your visitors to a Mailchimp audience. You build the sign-up form in HTML, with full control over its fields, and display it with a block, a widget, the `[mc4wp_form]` shortcode or the `mc4wp_show_form()` PHP function. Campaigns, email templates and contact management stay in Mailchimp: the plugin is only the bridge.\n\nIts other use, often the more valuable one, is a sign-up checkbox added to forms you already have: the WordPress comment and registration forms, [Contact Form 7](https://www.wp-masquerade.com/features/camouflaged-plugins/contact-form-7/), WPForms, Gravity Forms, Ninja Forms, WooCommerce checkout, BuddyPress, MemberPress, Easy Digital Downloads, Give and more. Each form includes a hidden trap field (a [honeypot](https://www.wp-masquerade.com/glossary/honeypot/)) and a submission timing check against bots. Scripts only load on pages that actually show a form.\n\nThe plugin is built by ibericode, the small team of Danny van Kooten, who started it in 2013. Mailchimp for WordPress Premium, a separate plugin sold on mc4wp.com, adds unlimited forms, submissions without a page reload, WooCommerce order sync, User Sync, email notifications, a visual Styles Builder and a local log of sign-ups.\n\n![Diagram: MC4WP: Mailchimp for WordPress works on visitors and bots, wordpress, external services. Public traces: signed HTML comments (removed, free version); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/mc4wp/diagram-en.svg?v=532a4128)\n\n## Which sites MC4WP is a good fit for\n\nMC4WP makes sense when your mailing list already lives in Mailchimp, or when you want it to:\n\n- **Blogs and editorial sites**: a simple sign-up form after posts or in the sidebar, plus a checkbox under the comment form.\n- **Business sites with a contact form**: a “Sign me up for the newsletter” checkbox drops into Contact Form 7, WPForms or Gravity Forms without switching form tools.\n- **WooCommerce stores**: a free sign-up checkbox at checkout; tracking purchases and abandoned carts in Mailchimp requires Premium.\n\nIt is the wrong pick if you don’t want Mailchimp: its free plan is capped at 250 contacts and 500 sends a month, and the bill grows with your list after that. A tool that sends email from WordPress, such as [MailPoet](https://www.wp-masquerade.com/features/camouflaged-plugins/mailpoet/), or another service such as Brevo, may suit you better.\n\n## MC4WP strengths and limitations\n\n### Strengths\n\n- **Plenty of free integrations.** The sign-up checkbox works with core WordPress forms, WooCommerce and the major form plugins.\n- **Cautious defaults.** Double opt-in on, checkbox unchecked and no implicit sign-ups unless you change them.\n- **Light on pages without a form.** The script only loads where a form appears, and the styling can inherit from your theme.\n- **HTML you control.** The form is a plain HTML form, easy to style with the `.mc4wp-form` and `.mc4wp-alert` classes.\n\n### Limitations\n\n- **One form in the free version.** You need Premium to create several forms, for example one per audience or per language.\n- **Submissions reload the page.** Submitting without a reload, which feels smoother to visitors, is a Premium feature.\n- **Mailchimp only.** The plugin is useless without a Mailchimp account, and switching email services means switching plugins.\n- **No built-in pop-up.** For a pop-up, the MC4WP documentation recommends the separate Boxzilla plugin.\n\n## The settings we recommend for MC4WP\n\nAll of these settings exist in the current free version, under the MC4WP menu in your dashboard.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **API Key**  MC4WP > Mailchimp | Set with the `MC4WP_API_KEY` constant in `wp-config.php` | The key stays out of the database (clear the field first) and the screen becomes read-only. |\n| **Use double opt-in?**  MC4WP > Form > Settings | Yes (default) | Subscribers confirm their address by email; the plugin warns that turning it off may affect your GDPR compliance. |\n| **Update existing subscribers?**  Same screen | No (default), unless you really need it | Stops a public form from overwriting an existing contact’s data based on nothing more than an email address. |\n| **Form Style**  MC4WP > Form > Appearance | Inherit from theme (default) or Basic | The first loads no extra stylesheet; pick Basic if the form looks broken with your theme. |\n| **Implicit?**  MC4WP > Integrations > your integration | No (default, recommended by the plugin) | With Yes, anyone who submits the form gets subscribed without asking for it. |\n| **Pre-check the checkbox?**  Same screen | No (default, recommended by the plugin) | A pre-checked box does not count as consent under the GDPR. |\n| **Double opt-in?**  Same screen | Yes (default) | Same reason as for the form: every address an integration adds gets confirmed. |\n| **Logging**  MC4WP > Other | Errors & warnings only (default) | Switch to Everything only while troubleshooting, then switch back. |\n| **Enable Site Tracking**  Same screen | Off (default), unless you use Mailchimp tracking | The Mailchimp tracking pixel then loads on every page: wire it into your cookie consent banner. |\n\n- On MC4WP > Mailchimp, check that the status reads “CONNECTED” and that your audience shows up in the list.\n- Sign up with a test address: the Mailchimp confirmation email should arrive, then the contact should appear in the audience.\n- If your site is cached, submit the form from a cached page in a private window to confirm the sign-up goes through.\n- If an integration is on, check that the sign-up checkbox shows up unchecked in that form.\n\n## MC4WP security: medium-severity flaws, regular fixes\n\nThe vulnerabilities published for MC4WP are medium severity. The most recent ones target how public forms are processed and the messages shown after a submission:\n\n- **CVE-2026-1781, up to version 4.11.1**: without an account, an attacker could force a form to unsubscribe contacts instead of subscribing them (CVSS 6.5). Version 4.12.0 removed unsubscribing through forms.\n- **CVE-2026-4561, up to version 4.12.0**: [stored XSS](https://www.wp-masquerade.com/glossary/xss/) through the form response messages, with an Author account (CVSS 6.4). Version 4.12.1 limits the HTML allowed in those messages.\n- **CVE-2024-8850, versions 4.9.9 to 4.9.16**: reflected XSS through the `email` parameter when a field used the `{email}` tag (CVSS 6.1), fixed in 4.9.17.\n\nVersion 4.15.0 also fixes a flaw that let a visitor subscribe an address to any audience in the connected Mailchimp account. So turn on automatic updates for MC4WP (see our guide to automatic plugin updates). The plugin also stamps each form with an HTML comment that gives its version number (see [HTML comments and the generator tag](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)): WP Masquerade removes it, which makes the plugin harder to spot for bots targeting these flaws, without replacing the update.\n\n## MC4WP frequently asked questions\n\n**Is MC4WP free?**\n\nYes, the wordpress.org plugin is free and covers one form plus the integration checkboxes. Premium costs $59 a year for one site, $99 for five sites and $249 for 25 sites, excluding tax, with a 30-day money-back guarantee.\n\n**Where do I find my Mailchimp API key?**\n\nIn your Mailchimp account, among the API keys in your profile: create a key just for this site, then paste it in MC4WP > Mailchimp or set it in the `MC4WP_API_KEY` constant. If the connection fails, your host must allow outgoing requests to api.mailchimp.com with the PHP cURL extension.\n\n**The form says success but no contact shows up in Mailchimp. Why?**\n\nWith double opt-in, the contact is only added after clicking the link in the confirmation email, which Mailchimp may send with a short delay. Also check the spam folder of your test address.\n\n**Can people still unsubscribe through an MC4WP form?**\n\nNo, not since version 4.12.0. The developer recommends using the Mailchimp hosted form instead, which verifies the address before unsubscribing it.\n\n## Key facts\n\n- Category: Newsletter, pop-ups and sharing\n- Vendor: ibericode\n- Price: Free; Premium from $59 per year for one site, excluding tax\n- Active installations (wordpress.org): 1 000 000+\n- Version: 4.15.0\n- Official page: https://wordpress.org/plugins/mailchimp-for-wp/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade\n- Removed by the free version: signed HTML comments\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes",
    "catalog": "mc4wp",
    "essentials": [
        "Best for blogs and stores whose mailing list is already managed in Mailchimp.",
        "Main caveat: only one form in the free version, and the plugin works with Mailchimp only.",
        "Free; Premium costs $59 a year for one site, with unlimited forms and WooCommerce tracking."
    ],
    "format": "application/json"
}