CVE-2026-110880: WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kit (formerly ConvertKit) convertkit pluginto a version that resolves this vulnerability.Fixed in 3.4.7
Event History
Frequently Asked Questions
What versions are affected?
The issue affects the Kit (formerly ConvertKit) WordPress plugin through version 3.4.6. The available data does not identify a fixed version.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact could successful exploitation have?
The supplied severity data indicates low-impact confidentiality and integrity effects, with no availability impact.