The vulnerability is a classic unauthenticated broken access control flaw in the WordPress Kit (formerly ConvertKit) plugin. It allows an attacker without any credentials to reach privileged plugin endpoints and manipulate data or perform actions that should be restricted to authenticated administrators. The weakness is identified as CWE-862, highlighting that access decisions are not correctly enforced, leading to unauthorized resource exposure.

Any WordPress installation that has the Kit (formerly ConvertKit) plugin version 3.3.5 or earlier is susceptible. The plugin is commonly found on sites that use it to manage email marketing and automation workflows. The vulnerability is present as long as the affected plugin version remains in use, with no apparent sub‑version granularity in the advisory.

The publicly disclosed CVSS score of 5.3 indicates a moderate risk level; the linear exploitation scenario requires no special privilege and can be performed over the public web interface. The EPSS score of less than 1% suggests that real-world exploitation is currently rare, the vulnerability has not been reported in the CISA KEV catalog. Nonetheless, an attacker who discovers this flaw could gain unauthorized control over configured marketing automations and potentially exfiltrate or alter user data. The attack vector is inferred to be remote via the website’s admin pages, where the broken check allows users to reach protected functionality without authentication.