Kit WordPress plugin: Broken access control
Summary
The WordPress Kit (formerly ConvertKit) plugin up to and including version 3.5.0 contains a missing authorization flaw, classified as broken access control. A remote, unauthenticated attacker may be able to access functions or data that should be restricted. According to the vendor's CVSS vector, the impact is limited to low confidentiality loss, with no integrity or availability impact.
Affected
- WordPress Kit (formerly ConvertKit) plugin, versions up to and including 3.5.0
- The NVD version range reads "n/a through 3.5.0"; treat 3.5.0 and earlier as affected
Fixed in
- Version 3.5.1 (according to the CNA record and OffSeq; confirmation against the WordPress.org changelog pending)
Workaround
- Unknown. No specific mitigation was found; updating to 3.5.1 or later is the recommended fix.
Exploitation
- Not known to be exploited (OffSeq); not listed in CISA KEV according to a third-party aggregator.
- A public PoC is claimed by OffSeq and a PoC index but is unverified.
Our recommendation
- Inventory WordPress sites that use the Kit plugin.
- Update the plugin to version 3.5.1 or later within the normal patch cycle.
- Check web server and plugin logs for unusual access to Kit-related endpoints.
- Fast-track the update if a PoC is confirmed.
- Keep the plugin at the latest version, as several broken access control issues have affected it recently.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
kanokwut/CVE-2026-125439-poc
Research sources
- Patchstack advisory patchstack.com
- CVE Record CVE-2026-125439 www.cve.org
- OffSeq radar entry radar.offseq.com
- WordPress.org plugin page wordpress.org
- Strix CVE entry CVE-2026-125439 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:46.
Original description (NVD)
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.