The vulnerability is a missing authorization flaw in the WordPress Kit (formerly ConvertKit) plugin, allowing an attacker to bypass access controls that are normally enforced for certain plugin functions or data. This flaw is classified under CWE-862, indicating that authenticated or unauthenticated users could be granted privileges they should not have. If exploited, an attacker could read, modify or delete plugin configuration data or user information stored by the plugin, potentially leading to privilege escalation within the WordPress site.

The issue affects the WordPress Kit (formerly ConvertKit) plugin for the vendor Kit, specifically all releases from the first version through version 3.4.6 inclusive. Any WordPress installation that has one of these plugin versions installed is potentially vulnerable.

The CVSS score of 6.5 suggests a moderate severity vulnerability, and the EPSS score is not available in the current data set. The vulnerability is not listed in the CISA KEV catalog. Because the plugin runs within the web application, the most likely attack vector is through HTTP requests to the WordPress site, exploiting the plugin’s administrative endpoints that lack proper authorization checks. An attacker would benefit from the ability to expand their privileges or gain sensitive configuration data, making the risk significant for sites that rely on this plugin for email marketing or user engagement features.