Unauthorized Data Access in GutenKit Mailchimp Integration for WordPress
CVE-2026-15827

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Gutenkit – Page Builder Blocks, Patterns, And Templates For Gutenberg Block Editor
Vendor
CVE Published:
23 July 2026

What is CVE-2026-15827?

The GutenKit Blocks plugin for WordPress is susceptible to unauthorized access due to inadequate permission checks on specific REST API endpoints. Attackers can exploit this vulnerability to retrieve sensitive Mailchimp audience configuration data, including API keys and metadata, without needing authentication or proper authorization. This security gap poses a significant risk for sites using the GutenKit Mailchimp integration, as it exposes private information that could be leveraged for malicious purposes.

Affected Version(s)

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor 0 <= 2.4.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/gutenkit-block...
https://plugins.trac.wordpress.org/browser/gutenkit-block...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Viet Anh Ngo
.