Description

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permission_callback => '__return_true', and their callbacks read the site's stored Mailchimp API key from the gutenkit_settings_list option and proxy Mailchimp audience/list, merge-field, interest-category, interest-name, and subscriber-count metadata back to the caller with no login, nonce, or capability check. This makes it possible for unauthenticated attackers to retrieve private Mailchimp audience configuration information from any site that has configured the GutenKit Mailchimp integration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-07-23T10:16:51.467Z",
  "pubdate": "2026-07-23T10:16:51.467Z",
  "executiveSummary": "The GutenKit Blocks plugin for WordPress in versions up to, and including, 2.4.12 is susceptible to an unauthorized access of data vulnerability via its REST API endpoints.\nThe flaw exists due to a missing capability check and improper access control enforcement on specific Mailchimp integration REST API endpoints, specifically /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests.\nThese endpoints are explicitly registered with a permission_callback returning __return_true, allowing unauthenticated attackers to bypass all authentication and authorization requirements.\nUpon exploitation, unauthenticated remote adversaries can query the endpoints to trigger backend callbacks that read the site's stored Mailchimp API key from the gutenkit_settings_list option.\nThe component subsequently proxies sensitive metadata back to the caller, including Mailchimp audience configuration, list details, merge-field structures, interest categories, interest names, and subscriber counts.\nThis unauthorized disclosure exposes internal marketing configurations and subscriber metrics, presenting notable information disclosure risks for affected WordPress environments.",
  "technicalDetails": "The vulnerability stems from improper authorization controls within the GutenKit Blocks plugin for WordPress versions up to, and including, 2.4.12.\nSpecifically, the REST API endpoints /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests fail to enforce any security validation checks such as nonces, user login verifications, or administrative capability checks.\nThe developer registered both vulnerable endpoints with the permission_callback parameter set to __return_true, which explicitly permits any incoming HTTP request to bypass access checks and execute the underlying callback functions.\nThe vulnerable component handles requests by reading the site-wide stored Mailchimp API key directly from the database option gutenkit_settings_list.\nOnce the API key is retrieved, the backend code communicates with the external Mailchimp service or leverages cached data to query and proxy audience/list metadata, merge-field configurations, interest categories, interest names, and subscriber counts back to the unauthenticated caller.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts an HTTP GET or POST request targeting either /wp-json/gutenkit/v1/mailchimp/get/lists or /wp-json/gutenkit/v1/mailchimp/get/interests over the network via standard HTTP/HTTPS protocols.\nBecause network exposure is public-facing and authentication requirements are entirely absent, the WordPress REST API processes the request without prompting for credentials or session cookies.\nThe plugin executes the vulnerable callback functions, retrieves the sensitive Mailchimp parameters, and serializes the metadata into the HTTP response payload.\nThe post-exploitation impact includes the exposure of internal mailing list structures, subscriber volume metrics, and potential leakage of the underlying Mailchimp API key functionality, which could facilitate further reconnaissance or targeted social engineering against the organization."
}