CVE-2026-19699

GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

Affected

GutenKit

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2026-08-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/

References

• CVE Record
• NVD entry