Live › vulnerability › CVE-2026-27063
The Kit (formerly ConvertKit) plugin for WordPress has a missing authorization check that allows access control to be exploited when security levels are misconfigured. The sources say versions through 3.4.7 are affected, and NVD rates it medium with CVSS 5.3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
The sources describe a missing authorization check in the Kit (formerly ConvertKit) plugin for versions through 3.4.7, triggered by incorrectly configured access control levels. Sites running that plugin version with those access settings are the ones to look at; the sources do not say which settings are involved.
No product ranges from the sources yet.
3.4.7 are affected.3.4.7; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-27063")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.