Live › vulnerability › CVE-2026-110880
Go to dashboardThe Kit (formerly ConvertKit) convertkit plugin has a missing authorization check, so access control is not enforced on some actions. The sources do not say exactly which data or actions an attacker could reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Kit (formerly ConvertKit) convertkit plugin at version or earlier are affected. The sources do not say which configurations or roles make a site more exposed.
3.4.6No product ranges from the sources yet.
wp plugin get convertkit --field=version3.4.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-110880")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.