CVE-2026-19699 PUBLISHED

GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

Assigner: WPScan
Reserved: 13.08.2026 Published: 20.08.2026 Updated: 20.08.2026

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

Product Status

Vendor Unknown
Product GutenKit
Versions Default: unaffected
  • affected from 2.4.12 to 2.5.0 (excl.)

Credits

  • Shikhali Jamalzade finder
  • WPScan coordinator

References

Problem Types

  • CWE-863 Incorrect Authorization CWE