EUVD-2026-63205
GHSA-hj3v-rcw6-wprx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress Contributor-role credentials
-
ExploitIdentify unprotected GutenKit REST API endpoints
-
ExecutionSend authenticated API request without sufficient capability
-
ImpactRetrieve mailing-list audience metadata from connected marketing account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must be running GutenKit version prior to 2.5.0 with the plugin active. The attacker must possess a valid WordPress account assigned the Contributor role or higher - unauthenticated visitors and Subscriber-role users cannot exploit this vulnerability. Additionally, the site must have a marketing or mailing-list platform connected through GutenKit's integration settings; without this connection, no audience metadata is present to expose. Exploitation is limited to read-only access to mailing-list audience metadata - no modification, deletion, or write operations are achievable through this vector. Sites that do not grant Contributor access to untrusted external users are not at practical risk. |
| Impact | The NVD-assigned CVSS score of 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N correctly reflects limited confidentiality impact and no integrity or availability risk, but the PR:H designation conflicts with the vulnerability description, which states exploitation is possible for users with the Contributor role - a low-privilege role in WordPress typically mapped to PR:L in CVSS. This discrepancy should be verified against the vendor's assessment, as the correct score under PR:L would be marginally higher. SSVC signals reinforce low urgency: exploitation is classified as none, automatable as no, and technical impact as partial. EPSS data is not provided in the available intelligence. Although a public proof-of-concept exists via WPScan, the authenticated prerequisite and read-only nature of the exposure substantially limit blast radius. This vulnerability represents a meaningful risk only for WordPress sites that grant Contributor access to untrusted external users AND have a high-value marketing audience connected through GutenKit. |
| Exploit ScenarioDerived | An attacker with a Contributor-level WordPress account - obtained through registration on a site with open user enrollment or via credential compromise - issues authenticated REST API requests to the unprotected GutenKit endpoints. Leveraging the publicly available WPScan proof-of-concept, the attacker retrieves mailing-list audience metadata from the site's connected marketing platform, potentially exposing subscriber counts, audience segment names, or list identifiers that could inform targeted phishing or competitive intelligence campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
RemediationAI
Upgrade GutenKit to version 2.5.0 or later, which contains the vendor-released patch correcting the insufficient capability check on the affected REST API endpoints, as confirmed by WPScan at https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/. As an interim compensating control prior to patching, administrators should audit and remove any untrusted or unnecessary Contributor-role accounts, since exploitation requires at minimum that role. If the connected marketing integration is not actively in use, disconnecting the external marketing account from GutenKit via the plugin's settings eliminates the exposed data surface entirely without affecting other plugin functionality. Disabling the plugin's REST API registration via custom code is a higher-friction workaround that may break legitimate block-builder features and is not recommended as a first-line option.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GutenKit is a Gutenberg-based block builder plugin for WordPress that includes integrations with external email marketing platforms. The vulnerability is rooted in CWE-863 (Incorrect Authorization): specific REST API endpoints within the plugin perform capability checks that are insufficiently restrictive, failing to enforce that only administrator-level or similarly privileged roles can access sensitive marketing account data. The affected code path exposes mailing-list audience metadata - likely subscriber counts, list names, or segment identifiers - sourced from the connected marketing account. CPE data identifies the affected product as cpe:2.3:a:unknown:gutenkit:*:*:*:*:*:*:*:* across versions up to but not including 2.5.0, with EUVD specifying 2.4.12 as the last known vulnerable release.
Know when Gutenkit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor role maps to PR:L in WordPress context; AV:N confirmed by REST API access; only limited confidentiality impact applies, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit a
Exploit-DB