{"id":"CVE-2026-125439","kind":"vulnerability","aliases":["CVE-2026-125439"],"related":[],"title":"Kit ConvertKit plugin: missing authorization check lets users bypass access controls","description":"Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.","summary":"The Kit (formerly ConvertKit) WordPress plugin, versions through 3.5.0, has a missing authorization check. The sources say it stems from incorrectly configured access control levels, so an attacker may reach functions they should not be allowed to use.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kit-convertkit","vendor","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Kit (ConvertKit) plugin version in the WordPress admin under Plugins; affected if it is `3.5.0` or earlier","fix":null,"status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:47+00:00","updated_at":"2026-11-11T12:28:47+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-11T12:28:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Kit ConvertKit plugin: missing authorization check lets users bypass access controls","impact":"medium","summary":"The Kit (formerly ConvertKit) WordPress plugin, versions through 3.5.0, has a missing authorization check. The sources say it stems from incorrectly configured access control levels, so an attacker may reach functions they should not be allowed to use.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["wordpress","kit-convertkit"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions","analyst_note":"Confirm the affected endpoints, required privileges and a fixed version from the NVD entry and the vendor's advisory.","how_to_check":"- Check the installed Kit (ConvertKit) plugin version in the WordPress admin under Plugins; affected if it is `3.5.0` or earlier\n- unknown for any further check; the sources do not say which endpoints or roles are involved","plain_action":"","product_name":"Kit (ConvertKit) WordPress plugin","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Kit (formerly ConvertKit) plugin at version 3.5.0 or earlier are likely exposed. The sources do not say which roles or settings make the missing check reachable, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4555,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125439':14A,17A '-2026':13A,16A '3.5.0':31B,86C 'access':10A,45B,74C 'affect':79C 'allow':58B,70C 'attack':50B 'author':5A,35B,62C 'bypass':9A 'check':6A,36B 'configur':44B,73C 'control':11A,46B,75C 'convertkit':2A,20B,26B,68C,69C,82C 'cve':12A,15A 'exploit':71C 'former':25B,67C,81C 'function':53B 'incorrect':43B,72C 'issu':78C 'kit':1A,19B,24B,65C,66C,80C 'kit-convertkit':18B 'let':7A 'level':47B 'levels.this':77C 'may':51B 'miss':4A,34B,61C 'n/a':84C 'plugin':3A,28B 'reach':52B 'say':39B 'secur':76C 'sourc':38B 'stem':41B 'use':60B 'user':8A 'vendor':21B 'version':29B 'vulner':63C 'wordpress':22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kit (formerly ConvertKit) plugin at version 3.5.0 or earlier are likely exposed. The sources do not say which roles or settings make the missing check reachable, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kitconvertkit","medium","vendor","wordpress"],"campaign_type":null,"search_a":"'-125439':14A,17A '-2026':13A,16A 'access':10A 'author':5A 'bypass':9A 'check':6A 'control':11A 'convertkit':2A 'cve':12A,15A 'kit':1A 'let':7A 'miss':4A 'plugin':3A 'user':8A","search_b":"'3.5.0':31B 'access':45B 'allow':58B 'attack':50B 'author':35B 'check':36B 'configur':44B 'control':46B 'convertkit':20B,26B 'former':25B 'function':53B 'incorrect':43B 'kit':19B,24B 'kit-convertkit':18B 'level':47B 'may':51B 'miss':34B 'plugin':28B 'reach':52B 'say':39B 'sourc':38B 'stem':41B 'use':60B 'vendor':21B 'version':29B 'wordpress':22B,27B","search_c":"'3.5.0':86C 'access':74C 'affect':79C 'allow':70C 'author':62C 'configur':73C 'control':75C 'convertkit':68C,69C,82C 'exploit':71C 'former':67C,81C 'incorrect':72C 'issu':78C 'kit':65C,66C,80C 'levels.this':77C 'miss':61C 'n/a':84C 'secur':76C 'vulner':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125439","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}