Kit (formerly ConvertKit)
Kit (formerly ConvertKit) connects WordPress websites with Kit for subscriber forms, newsletters, and email marketing.
Kit (formerly ConvertKit) (convertkit) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 6.5.
convertkitCVE-2026-27063: Kit (formerly ConvertKit): Missing authorization
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 3.4.7.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-27063
Kit (formerly ConvertKit): Missing authorization
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 3.4.7.
|
3.4.8 |
CVE5.3
|
| Oct 18, 2026 |
CVE-2026-110880
Kit (formerly ConvertKit): Unauthenticated authorization bypass
Kit (formerly ConvertKit) is a WordPress plugin affected through 3.4.6. The CNA vector requires no authenticated privileges. In this vulnerability, a protected operation lacks the required authorization check; the CNA rates confidentiality and integrity impacts low and availability impact none, without identifying the affected operation or resource. The export does not disclose a concrete endpoint, action, parameter, function, or full input-to-operation path beyond those facts. The completed CNA record identifies 3.4.7 as fixed.
|
3.4.7 |
CVE6.5
|
| Jul 23, 2026 |
CVE-2026-65472
Kit (formerly ConvertKit): Broken access control
Kit (formerly ConvertKit) is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.3.5.
|
3.3.6 |
CVE5.3
|
| Apr 10, 2024 |
CVE-2024-31245
ConvertKit: A security weakness
ConvertKit is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
|