{"id":"CVE-2026-27063","kind":"vulnerability","aliases":["CVE-2026-27063"],"related":[],"title":"Kit (ConvertKit) WordPress plugin: missing authorization check through version 3.4.7","description":"Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.","summary":"The Kit (formerly ConvertKit) plugin for WordPress has a missing authorization check that allows access control to be exploited when security levels are misconfigured. The sources say versions through 3.4.7 are affected, and NVD rates it medium with CVSS 5.3.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["convertkit","kit","package","wordpress"],"not_affected_if":["plugin-version-above-3.4.7"],"how_to_check":"- Check the installed version of the Kit (formerly ConvertKit) plugin in the WordPress admin plugin list; the sources say versions through `3.4.7` are affected.","fix":"- Move the Kit (formerly ConvertKit) plugin to a version later than `3.4.7`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T15:17:22+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:54+00:00","updated_at":"2026-10-29T15:26:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Kit (formerly ConvertKit) plugin to a version later than `3.4.7`; the sources do not name the exact fixed version.","reach":"unknown","title":"Kit (ConvertKit) WordPress plugin: missing authorization check through version 3.4.7","impact":"medium","summary":"The Kit (formerly ConvertKit) plugin for WordPress has a missing authorization check that allows access control to be exploited when security levels are misconfigured. The sources say versions through 3.4.7 are affected, and NVD rates it medium with CVSS 5.3.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kit","convertkit"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform actions the access controls should block","analyst_note":"Confirm the affected plugin, the fixed version and the exact misconfiguration from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-27063 or the WordPress plugin changelog.","how_to_check":"- Check the installed version of the Kit (formerly ConvertKit) plugin in the WordPress admin plugin list; the sources say versions through `3.4.7` are affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-version-above-3.4.7"],"who_is_affected":"The sources describe a missing authorization check in the Kit (formerly ConvertKit) plugin for versions through 3.4.7, triggered by incorrectly configured access control levels. Sites running that plugin version with those access settings are the ones to look at; the sources do not say which settings are involved.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4127,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-27063':13A,16A '3.4.7':10A,50B,86C '5.3':60B 'access':35B,74C 'affect':52B,79C 'allow':34B,70C 'author':6A,31B,62C 'check':7A,32B 'configur':73C 'control':36B,75C 'convertkit':2A,17B,24B,68C,69C,82C 'cve':11A,14A 'cvss':59B 'exploit':39B,71C 'former':23B,67C,81C 'incorrect':72C 'issu':78C 'kit':1A,18B,22B,65C,66C,80C 'level':42B 'levels.this':77C 'medium':57B 'misconfigur':44B 'miss':5A,30B,61C 'n/a':84C 'nvd':54B 'packag':19B 'plugin':4A,25B 'rate':55B 'say':47B 'secur':41B,76C 'sourc':46B 'version':9A,48B 'vulner':63C 'wordpress':3A,20B,27B","nicknames":[],"mitigations":[],"who_affected":"The sources describe a missing authorization check in the Kit (formerly ConvertKit) plugin for versions through 3.4.7, triggered by incorrectly configured access control levels. Sites running that plugin version with those access settings are the ones to look at; the sources do not say which settings are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-27063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27063","severity":null,"published_at":"2026-10-29T15:17:22+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}