CVE-2026-125439

MEDIUM NVD

CVSS Score 5.3

Severity MEDIUM

Published Nov 11, 2026

Vendor unknown

Description

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.

References

https://patchstack.com/database/wordpress/plugin/convertkit/vulnerability/wordpress-kit-formerly-convertkit-plugin-3-5-0-broken-access-control-vulnerability?_s_id=cve