What is the CVSS score of CVE-2026-15827?

CVE-2026-15827 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

GutenKit Blocks CVE-2026-15827

EUVD-2026-47926 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Wordfence

GHSA-phq4-ggcm-gj84

WordPress Authentication Bypass Wordpress Plugin Gutenkit Page Builder Blocks Patterns And Templates For Gutenberg Block Editor

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication or user interaction required; confidentiality-only impact limited to Mailchimp API key and audience metadata leak from the WordPress site itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 09:46 vuln.today

CVE Published

Jul 23, 2026 - 08:34 cve.org

MEDIUM 5.3

DescriptionCVE.org

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permission_callback => '__return_true', and their callbacks read the site's stored Mailchimp API key from the gutenkit_settings_list option and proxy Mailchimp audience/list, merge-field, interest-category, interest-name, and subscriber-count metadata back to the caller with no login, nonce, or capability check. This makes it possible for unauthenticated attackers to retrieve private Mailchimp audience configuration information from any site that has configured the GutenKit Mailchimp integration.

AnalysisAI

GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.

Technical ContextAI

CWE-862 (Missing Authorization) is the root cause. WordPress REST API routes registered with permission_callback set to the built-in '__return_true' helper bypass all authentication and capability checks, granting access to every caller regardless of login state or role. The GutenKit plugin (CPE: cpe:2.3:a:ataurr:gutenkit_-_page_builder_blocks,_patterns,_and_templates_for_gutenberg_block_editor:*:*:*:*:*:*:*:*) stores the administrator-supplied Mailchimp API key in the gutenkit_settings_list WordPress option and reads it directly in the REST callback, proxying Mailchimp API responses (audience lists, merge fields, interest categories, interest names, subscriber counts) back to the unauthenticated caller. Source code confirmed at WordPress.org Trac browser for tags 2.4.6 and 2.4.11, specifically MailChimp.php lines 17, 43, 62, and 141, showing the defective registration across multiple historical versions.

RemediationAI

Update GutenKit Blocks to the version released after 2.4.12 incorporating the upstream fix commit referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3618270%40gutenkit-blocks-addon&new=3618270%40gutenkit-blocks-addon; note that the exact patched release version number is not independently confirmed from available data, so verify the current WordPress.org plugin directory version before upgrading. As an immediate compensating control, administrators should remove the Mailchimp API key from GutenKit settings, which clears the gutenkit_settings_list option and renders the vulnerable endpoints non-functional - the trade-off is loss of Mailchimp integration functionality until patching is complete. If the integration must remain active, rotate the Mailchimp API key immediately and issue a new scoped key with the minimum required permissions, limiting the blast radius of any prior exposure. A WAF rule blocking unauthenticated requests to /wp-json/gutenkit/v1/mailchimp/ provides network-layer mitigation but may break legitimate front-end functionality if the plugin relies on these endpoints for visitor-facing features. Consult the full Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7430594c-3a71-4b24-875b-014e03be868f for additional context.