The vulnerability resides in the GutenKit Blocks plugin for WordPress, where two REST API endpoints – /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests – lack any capability check. The endpoints are registered with a permission callback that always returns true, allowing any user to invoke them without authentication, a nonce, or capability validation. As a result, the callbacks can read the site’s stored Mailchimp API key from the gutenkit_settings_list option and proxy its audience, merge-field, interest-category, interest-name, and subscriber-count data back to the caller. This design permits an unauthenticated attacker to retrieve private Mailchimp configuration and membership details from any site that has enabled the GutenKit Mailchimp integration.

Affected products belong to the GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor suite. The vulnerability is present in all versions up to and including 2.4.12, with earlier releases such as 2.4.6 and 2.4.11 also containing the same implementation flaws.

The CVSS base score of 5.3 indicates moderate impact with no network or code execution capabilities, but the vulnerability does allow information disclosure. The EPSS score of less than 1% suggests a very low but nonzero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP request to the exposed REST endpoints, requiring only the ability to contact the target WordPress installation. If successful, the attacker can pull sensitive Mailchimp configuration and subscriber metrics, potentially enabling further social engineering attacks or data aggregation. Post‑incident, the exposure could lead to credential misuse or advanced phishing campaigns if the attacker obtains API keys that allow other actions in the Mailchimp account.