Improper Access Control in GutenKit Plugin for WordPress
CVE-2026-19699
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19699?
The GutenKit plugin for WordPress, prior to version 2.5.0, lacks adequate capability verification on certain REST API endpoints. This oversight allows users with Contributor privileges and higher to access sensitive mailing-list audience metadata linked to the site's marketing account. Without proper access restrictions, this vulnerability could potentially expose confidential information, making it essential for site administrators to upgrade to the latest version to mitigate risks.
Affected Version(s)
GutenKit 2.4.12 < 2.5.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.