EUVD-2026-48084
GHSA-v6j9-2j4c-j36f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible unauthenticated endpoint (AV:N/PR:N), no complexity or interaction barriers (AC:L/UI:N), limited to integrity impact only (I:L) with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
AnalysisAI
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-862 (Missing Authorization) describes a class of flaws where software does not perform an authorization check when an actor attempts to access a resource or perform an action. The affected product, identified via CPE cpe:2.3:a:kit:kit_(formerly_convertkit):*:*:*:*:*:*:*:*, is the Kit plugin for WordPress - an email marketing and subscriber management integration formerly branded as ConvertKit. WordPress plugins commonly register AJAX handlers or REST API endpoints; when authorization nonces or capability checks (e.g., current_user_can()) are absent or bypassable, unauthenticated HTTP requests can invoke privileged functionality. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable endpoint is reachable over the network with no authentication, no interaction, and no complexity barrier.
RemediationAI
Update the Kit (formerly ConvertKit) WordPress plugin to a version above 3.3.5 as soon as a patched release is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/convertkit/vulnerability/wordpress-kit-formerly-convertkit-plugin-3-3-5-broken-access-control-vulnerability) or the WordPress plugin repository changelog. If immediate patching is not possible, a compensating control is to temporarily deactivate the Kit plugin on critical sites until a fix is available - this eliminates the attack surface entirely but disables email marketing integrations. Site administrators using web application firewalls (WAF) such as Wordfence or Sucuri can attempt to create rules blocking unauthenticated requests to Kit plugin endpoints, though this requires knowing the specific vulnerable endpoint and may cause false positives. No patched version number has been independently confirmed from the provided input data; do not assume any specific version is safe until verified against the vendor advisory.
SvelteKit is a web development kit. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authe
Remote denial-of-service in @sveltejs/kit (versions ≤ 2.70.1) is achievable by any unauthenticated attacker who sends a
SvelteKit 2.19.0-2.49.4 has SSRF/DoS affecting applications with prerendered routes. Can be exploited to make the server
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who subm
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the s
Request body size limit bypass in SvelteKit adapter-node allows unauthenticated attackers to submit oversized payloads,
SvelteKit versions 2.49.0 through 2.49.4 are vulnerable to denial-of-service attacks through the experimental form remot
Uncontrolled payload size acceptance in SvelteKit's remote form function handler allows unauthenticated remote attackers
SvelteKit versions prior to 2.57.1 are vulnerable to denial of service when the redirect() function is called from the h
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition i
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from Java
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today