CVE-2026-19699

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

CVSS v3.1

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.22% chance of exploitation in the next 30 days, 12th percentile

Published

2026-08-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/

References

• CVE Record
• NVD entry

Related

• CVE-2026-19697
• CVE-2026-1970
• CVE-2026-1969
• CVE-2026-19709
• CVE-2026-19681
• CVE-2026-1971