CVE-2026-105421: WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kit (formerly ConvertKit) for WooCommerceto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects Kit (formerly ConvertKit) for WooCommerce versions through 2.2.0. The available data does not identify a fixed version.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-accessible exploitation with low complexity, no privileges required, and no user interaction required.
What is the expected impact?
The supplied severity data indicates integrity impact only, rated low. No confidentiality or availability impact is specified.