Kit for WooCommerce CVE-2026-105421

Requires the Kit (formerly ConvertKit) for WooCommerce plugin to be installed and active on a WordPress/WooCommerce site at a version from n/a through 2.2.0, with the vulnerable endpoint network-reachable. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, so exploitation works against default configurations. The practical limiting factor is the impact ceiling: only LOW integrity is affected (C:N/A:N), so an attacker can tamper with limited plugin-controlled data but cannot exfiltrate confidential data or cause denial of service; exposure also depends on the site running the affected plugin, which is a specific add-on rather than core WordPress.

This is a moderate-severity Missing Authorization (CWE-862) flaw with CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The vector indicates remote, network-reachable exploitation with low attack complexity and no privileges or user interaction required, but the impact is constrained to LOW integrity only (C:N/A:N), meaning an attacker can modify some limited data but cannot read sensitive information or disrupt availability. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - no public exploit identified at time of analysis. The ease-of-access signals (PR:N, AC:L) are offset by the narrow, low-integrity consequence, so this is a genuine-but-limited hygiene fix rather than an emergency: realistic priority is moderate, appropriate for routine patch cycles on affected WordPress sites rather than emergency out-of-band patching. No conflicting signals were observed; the CVSS network vector is consistent with a WordPress plugin endpoint lacking an authorization check.

An unauthenticated remote attacker sends a crafted request directly to a plugin endpoint or action in the Kit (formerly ConvertKit) for WooCommerce plugin (versions through 2.2.0) that fails to verify the caller's permissions. Because of the missing authorization check, the attacker performs an action or modifies data they should not be able to, consistent with the low integrity impact. No public proof-of-concept exploit is identified in the provided data.