CVE-2026-27063: WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kit (formerly ConvertKit) pluginto a version that resolves this vulnerability.Fixed in 3.4.8
Event History
Frequently Asked Questions
Which installations should be considered affected?
Installations using the Kit (formerly ConvertKit) plugin at version 3.4.7 or earlier should be considered affected. The affected-version range is reported as beginning at an unspecified version.
Does exploitation require an authenticated WordPress account or user interaction?
No. The reported vector indicates network-based exploitation with no privileges required and no user interaction required. Attack complexity is rated low.
What is the reported security impact?
The reported impact is limited to low confidentiality impact. No integrity or availability impact is reported.