Authorization Bypass in Kit (Formerly ConvertKit) for WooCommerce

CVE-2026-105421

What is CVE-2026-105421?

A missing authorization vulnerability exists in the Kit (formerly ConvertKit) plugin for WooCommerce, primarily due to incorrectly configured access control security levels. This flaw allows unauthorized users to exploit the plugin, potentially leading to unauthorized access to sensitive features and data. The vulnerability impacts all versions up to and including 2.2.0, making it imperative for users to evaluate their installations and implement corrective measures to safeguard against potential exploitation.

References