CVE-2026-19699CWE-863broken-access-control
CVE-2026-19699
Low · published August 20, 2026
What it is
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
The record
Technical detail
- CVSS v3.1
- 2.7 · LOW
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00299 · 21.4th percentile
- Weakness
- CWE-863 · Incorrect Authorization
- Published
- 2026-08-20T10:17Z
References (1)
EPSS history
Timeline