{
 "id": "WPSEC-2026-2852",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2852/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2852/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2852/index.md",
 "title": "Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership <= 3.5.0 - Unauthenticated Sensitive Information Exposure via Site Search",
 "description": "The Kit (formerly ConvertKit) plugin for WordPress is vulnerable to Sensitive Information Exposure via the site search in all versions up to, and including, 3.5.0. This is due to restricted Member Content pages and posts being included in search results when the search terms match only their hidden content. This makes it possible for unauthenticated attackers to find out, by searching, whether specific words appear in member-only content.",
 "plugin": {
  "slug": "convertkit",
  "name": "Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership",
  "full_name": "Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership",
  "wordpress_org": "https://wordpress.org/plugins/convertkit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/convertkit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/convertkit"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1.0",
    "from_inclusive": true,
    "to": "3.5.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1.0 before 3.5.1"
  ]
 },
 "introduced_in": "2.1.0",
 "fixed_in": "3.5.1",
 "remediation": "Update to 3.5.1 or later.",
 "fix_released": "2026-11-10T06:14:36+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:04:38.899439+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2852/",
  "https://plugins.svn.wordpress.org/convertkit/tags/3.5.1/",
  "https://wordpress.org/plugins/convertkit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/convertkit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}