CVE-2026-110880
CVE-2026-110880 · WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
kit (formerly convertkit)
- Versions
- ≥ 0, ≤ 3.4.6: Affected; ≥ 3.4.7: Not affected (custom)
Update to 3.4.7