# Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership <= 3.5.0 - Unauthenticated Sensitive Information Exposure via Site Search

- **ID:** WPSEC-2026-2852
- **Plugin:** Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership (`convertkit`), https://wordpress.org/plugins/convertkit/
- **Affected versions:** from 2.1.0 before 3.5.1
- **Fixed in:** 3.5.1 (Update to 3.5.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/convertkit
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2852/

## Description

The Kit (formerly ConvertKit) plugin for WordPress is vulnerable to Sensitive Information Exposure via the site search in all versions up to, and including, 3.5.0. This is due to restricted Member Content pages and posts being included in search results when the search terms match only their hidden content. This makes it possible for unauthenticated attackers to find out, by searching, whether specific words appear in member-only content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2852/
- https://plugins.svn.wordpress.org/convertkit/tags/3.5.1/
- https://wordpress.org/plugins/convertkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2852/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.