# Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie

- **ID:** WPSEC-2026-1071
- **Plugin:** Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages (`convertkit`), https://wordpress.org/plugins/convertkit/
- **Affected versions:** all versions before 3.4.7
- **Fixed in:** 3.4.7 (Update to 3.4.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/convertkit
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1071/

## Description

The Kit (formerly ConvertKit) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the 'ck_subscriber_id' URL parameter and cookie in all versions up to, and including, 3.4.6. This is due to the plugin trusting a numeric subscriber ID taken from the request or cookie without verifying that it belongs to the visitor, either against the subscriber's hashed email address or with a cookie signature. This makes it possible for unauthenticated attackers to supply another subscriber's numeric ID and inherit that subscriber's tag, form or product access, letting them view content restricted to subscribers through the Member Content feature and the Custom Content block and shortcode.

## References

- https://wpsec.com/vuln/WPSEC-2026-1071/
- https://plugins.svn.wordpress.org/convertkit/tags/3.4.7/
- https://wordpress.org/plugins/convertkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1071/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.