Kit Formerly Convertkit
Monthly
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.