---
id: "CVE-2026-27063"
kind: "vulnerability"
aliases: ["CVE-2026-27063"]
title: "Kit (ConvertKit) WordPress plugin: missing authorization check through version 3.4.7"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["convertkit", "kit", "package", "wordpress"]
not_affected_if: ["plugin-version-above-3.4.7"]
published_at: "2026-10-29T15:17:22+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:26:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27063", "first_seen_at": "2026-10-29T15:25:39+00:00"}]
---

# Kit (ConvertKit) WordPress plugin: missing authorization check through version 3.4.7

The Kit (formerly ConvertKit) plugin for WordPress has a missing authorization check that allows access control to be exploited when security levels are misconfigured. The sources say versions through 3.4.7 are affected, and NVD rates it medium with CVSS 5.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Kit (formerly ConvertKit) plugin in the WordPress admin plugin list; the sources say versions through `3.4.7` are affected.

## Fix

- Move the Kit (formerly ConvertKit) plugin to a version later than `3.4.7`; the sources do not name the exact fixed version.

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-27063

## From the sources

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_