{
 "id": "WPSEC-2026-1071",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1071/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1071/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1071/index.md",
 "title": "Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie",
 "description": "The Kit (formerly ConvertKit) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the 'ck_subscriber_id' URL parameter and cookie in all versions up to, and including, 3.4.6. This is due to the plugin trusting a numeric subscriber ID taken from the request or cookie without verifying that it belongs to the visitor, either against the subscriber's hashed email address or with a cookie signature. This makes it possible for unauthenticated attackers to supply another subscriber's numeric ID and inherit that subscriber's tag, form or product access, letting them view content restricted to subscribers through the Member Content feature and the Custom Content block and shortcode.",
 "plugin": {
  "slug": "convertkit",
  "name": "Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages",
  "full_name": "Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages",
  "wordpress_org": "https://wordpress.org/plugins/convertkit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/convertkit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/convertkit"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.7",
 "remediation": "Update to 3.4.7 or later.",
 "fix_released": "2026-10-15T04:33:27+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:07.606952+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1071/",
  "https://plugins.svn.wordpress.org/convertkit/tags/3.4.7/",
  "https://wordpress.org/plugins/convertkit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/convertkit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}