CVE-2026-27063

MediumCVSS 5.3

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Kit plugin (formerly ConvertKit) up to version 3.4.7 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker may perform actions they are not authorized to perform, potentially leading to unauthorized access to functionality or data.

Recommendation

Update Kit to a version newer than 3.4.7 as soon as it is available and review the permission configuration.

Other vulnerabilities in Kit (formerly ConvertKit)

CVE-2026-110880Medium
The Kit (formerly ConvertKit) plugin for WordPress (up to version 3.4.6) has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can perform operations they are not authorized to do.

Original NVD description (English source)

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS