What is the CVSS score of CVE-2024-31245?

CVE-2024-31245 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Which versions of ConvertKit Plugin are affected by CVE-2024-31245?

ConvertKit's WordPress email marketing plugin (through v2.4.5) directly exposes subscriber email addresses in web-accessible plugin log files, allowing unauthenticated attackers to harvest customer…

How to fix or mitigate CVE-2024-31245?

Within 24 hours: identify all WordPress installations running ConvertKit plugin versions through 2.4.5 using WP-CLI audits; immediately configure web server access controls (via .htaccess or nginx) to deny HTTP access to wp-content/plugins/convertkit/logs/ and similar plugin-generated directories; review recent server access logs for evidence of unauthorized log file downloads. Within 7 days: monitor ConvertKit security advisories for patch releases and escalate to vendor support regarding remediation timeline; validate file permissions on all plugin directories ensure logs are not world-readable (chmod 600 minimum); implement monitoring of access attempts to plugin log directories. Within 30 days: upgrade to a patched ConvertKit version if released by vendor, or migrate to alternative email marketing integrations (Mailchimp, Brevo, or native WordPress email solutions) as permanent remediation.

ConvertKit Plugin CVE-2024-31245

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2024-04-10 audit@patchstack.com

Information Disclosure Convertkit Email Marketing Email Newsletter And Landing Pages Convertkit

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

WordPress plugin log files in wp-content are web-accessible by default; no authentication needed to retrieve them, but only confidentiality is impacted.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 12, 2026 - 18:30 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 12, 2026 - 18:22 vuln.today

cvss_changed

Severity Changed

Aug 12, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

Aug 12, 2026 - 18:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

CVE Published

Apr 10, 2024 - 16:15 cve.org

MEDIUM 5.3

DescriptionNVD

Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5.

AnalysisAI

ConvertKit's WordPress email marketing plugin (versions through 2.4.5) writes subscriber email addresses into plugin log files that may be directly accessible over HTTP, exposing personally identifiable information to unauthenticated remote attackers. The NVD-assigned CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects scenarios where the plugin stores logs within the web-accessible wp-content directory without access controls. No public exploit exists and no KEV listing is present; EPSS at 0.99% (77th percentile) signals a below-average but non-negligible exploitation probability relative to all CVEs.

Technical ContextAI

CWE-532 (Insertion of Sensitive Information into Log File) describes a class of flaw where an application writes sensitive runtime data - in this case subscriber email addresses - into log files without sanitization or access control. The affected product is the ConvertKit email marketing, newsletter, and landing pages plugin for WordPress (CPE: cpe:2.3:a:convertkit:convertkit_-_email_marketing,_email_newsletter_and_landing_pages:*:*:*:*:*:wordpress:*:*). WordPress plugin directories under wp-content/plugins/ are served by the web server by default; unless the site owner or plugin adds .htaccess deny rules or a web server-level block for log file extensions, files stored there are directly retrievable via HTTP. ConvertKit's plugin handles subscriber intake and email delivery flows, meaning operational logs may contain user-submitted email addresses passed through those flows.

RemediationAI

Update the ConvertKit WordPress plugin to a version beyond 2.4.5; the exact patched release version is not independently confirmed in the provided data - verify the current release on the WordPress.org plugin repository or via the Patchstack advisory at https://patchstack.com/database/vulnerability/convertkit/wordpress-convertkit-plugin-2-4-5-email-disclosure-in-log-file-vulnerability before deploying. As an interim compensating control, add an .htaccess rule within the wp-content/plugins/convertkit/ directory to deny HTTP access to log files (e.g., 'Deny from all' or a FilesMatch rule blocking .log extensions); this prevents remote retrieval but does not stop the underlying logging behavior. Alternatively, configure the web server (nginx location block or Apache Directory directive) to block direct access to .log files under the web root. Note that neither workaround eliminates log file creation - sensitive data continues to be written to disk, creating a residual local access risk until the plugin is patched. Rotating and purging existing log files after patching is advisable.