Kit (ConvertKit) CVE-2026-110880

Exploitation requires only that a target site runs the Kit (formerly ConvertKit) WordPress plugin at version 3.4.6 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) it is remotely reachable with no authentication, no special privileges, and no user interaction against default installations. The description does not name the exact vulnerable feature, endpoint, or configuration setting, so the precise request path cannot be stated with confidence from available data. The main limiting factor is scope of impact rather than access: S:U with C:L/I:L/A:N means an attacker gains only limited unauthorized read/write to specific plugin data or functions, not full site takeover; upgrading past 3.4.6 removes exposure.

This is a mid-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the Kit/ConvertKit WordPress plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity issue requiring no privileges and no user interaction, which makes it broadly reachable, but impact is capped: S:U, C:L, I:L, A:N means only limited confidentiality and integrity exposure and no availability impact - consistent with an attacker reaching a function or data that should be access-controlled rather than achieving full compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or mass-scanning at this time; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: this is a legitimate patch-worthy issue because it is unauthenticated and network-facing, but it is not currently an emergency-tier (KEV/weaponized) item - the limited C:L/I:L/A:N impact and absence of exploitation signals place it in routine-but-prompt remediation. Note the conflict in labeling: the vulnerability is Missing Authorization/Broken Access Control per CWE-862 and Patchstack, whereas the input tag calls it 'Authentication Bypass' - these are related but distinct and the CWE should be treated as authoritative.

An unauthenticated attacker sends a crafted HTTP request directly to a plugin endpoint or AJAX action that fails to verify the caller's authorization, allowing them to read or modify data/functionality that should be restricted. Because no authentication, privileges, or user interaction are required (PR:N/UI:N), the request can be issued remotely against any site running the vulnerable plugin version. No public proof-of-concept was identified in the provided data.