Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-27063 EUVD-2026-112881GHSA-v8mj-3w3m-jr85

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.

Affected products

VendorProductAffectedFixed
Kit Kit (formerly ConvertKit) ≤ 3.4.7 —

References