Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie

ID

WPSEC-2026-1071

Plugin

Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages (convertkit)

Affected

all versions before 3.4.7

Remediation

Update to 3.4.7 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-639

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16

Attack surface

Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages on WPSec AttackSurface

Fix released

2026-10-15

Published

2026-10-16

Description

The Kit (formerly ConvertKit) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the 'ck_subscriber_id' URL parameter and cookie in all versions up to, and including, 3.4.6. This is due to the plugin trusting a numeric subscriber ID taken from the request or cookie without verifying that it belongs to the visitor, either against the subscriber's hashed email address or with a cookie signature. This makes it possible for unauthenticated attackers to supply another subscriber's numeric ID and inherit that subscriber's tag, form or product access, letting them view content restricted to subscribers through the Member Content feature and the Custom Content block and shortcode.

References

• https://wpsec.com/vuln/WPSEC-2026-1071/
• https://plugins.svn.wordpress.org/convertkit/tags/3.4.7/
• https://wordpress.org/plugins/convertkit/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS