CVE-2026-110880

9th percentile - higher than 9% of all known CVEs

The Kit (formerly ConvertKit) plugin for WordPress (up to version 3.4.6) has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can perform operations they are not authorized to do.

This may lead to modification of plugin settings, access to subscriber data, or other administrative actions. As a result, an attacker could disrupt the site or violate user privacy.

Update the Kit plugin to the latest version (above 3.4.6). Verify user role permissions and apply the principle of least privilege.