CVE-2026-125439: WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability

Q: Which deployments are affected?

Kit (formerly ConvertKit) plugin versions through 3.5.0 are affected. The available data does not identify a safe fixed version.

Q: Can this be exploited remotely without an account?

The vector is network-based and the listed metrics indicate low attack complexity, no privileges required, and no user interaction required. A proof of concept was published on 2026-11-03.

Q: What is the expected impact?

The listed impact is limited confidentiality impact, with no integrity or availability impact indicated. The issue is categorized as broken access control caused by missing authorization or incorrectly configured access-control levels.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Kit (formerly ConvertKit) plugin to a version that resolves this vulnerability.
Fixed in 3.5.1

Event History

Nov 3, 2026

Exploit Published

via GitHub·01:02 PM

Nov 11, 2026

CVE Published

via MITRE·11:42 AM

Data Sourced

via MITRE·11:42 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Kit (formerly ConvertKit) plugin versions through 3.5.0 are affected. The available data does not identify a safe fixed version.

Can this be exploited remotely without an account?

The vector is network-based and the listed metrics indicate low attack complexity, no privileges required, and no user interaction required. A proof of concept was published on 2026-11-03.

What is the expected impact?

The listed impact is limited confidentiality impact, with no integrity or availability impact indicated. The issue is categorized as broken access control caused by missing authorization or incorrectly configured access-control levels.

CVE-2026-125439: WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Can this be exploited remotely without an account?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Can this be exploited remotely without an account?

What is the expected impact?