EUVD-2026-63205
GHSA-hj3v-rcw6-wprx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor role maps to PR:L in WordPress context; AV:N confirmed by REST API access; only limited confidentiality impact applies, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
AnalysisAI
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must be running GutenKit version prior to 2.5.0 with the plugin active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS score of 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N correctly reflects limited confidentiality impact and no integrity or availability risk, but the PR:H designation conflicts with the vulnerability description, which states exploitation is possible for users with the Contributor role - a low-privilege role in WordPress typically mapped to PR:L in CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a Contributor-level WordPress account - obtained through registration on a site with open user enrollment or via credential compromise - issues authenticated REST API requests to the unprotected GutenKit endpoints. Leveraging the publicly available WPScan proof-of-concept, the attacker retrieves mailing-list audience metadata from the site's connected marketing platform, potentially exposing subscriber counts, audience segment names, or list identifiers that could inform targeted phishing or competitive intelligence campaigns. |
| Remediation | Upgrade GutenKit to version 2.5.0 or later, which contains the vendor-released patch correcting the insufficient capability check on the affected REST API endpoints, as confirmed by WPScan at https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today