Description

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-20T06:17:13.167Z",
  "pubdate": "2026-08-20T06:17:13.167Z",
  "executiveSummary": "An insufficient capability check vulnerability exists within the REST API implementation of the GutenKit WordPress plugin prior to version 2.5.0. This authorization flaw permits authenticated remote attackers assigned the Contributor role or higher to improperly access and retrieve sensitive mailing-list audience metadata originating from the website's connected marketing accounts.\nThe vulnerability arises from a lack of strict access control enforcement on specific REST API endpoints, allowing users with low-privileged roles to query information outside their intended security context. The impact includes the unauthorized disclosure of marketing infrastructure metadata, which can facilitate targeted reconnaissance, social engineering, or subsequent attacks against connected external services.\nExploitation of this vulnerability requires network access to the target WordPress instance and an active user session with at least Contributor-level privileges. No complex interaction or advanced attacker capabilities are required beyond the possession of valid low-privileged credentials.",
  "technicalDetails": "The vulnerability resides within the REST API architecture of the GutenKit WordPress plugin affecting versions prior to 2.5.0. Specifically, certain custom REST API endpoints fail to implement adequate capability checks or role-based access validation routines before processing incoming requests and returning data.\nIn WordPress, the REST API relies on permission callbacks to verify whether the current user possesses the necessary capabilities (such as manage_options or edit_posts) to execute a specific request. In the vulnerable versions of GutenKit, the affected REST API endpoints either omit these permission callbacks entirely or utilize overly permissive checks that incorrectly validate user capabilities.\nThe attack flow proceeds as follows: an attacker with authenticated access at the Contributor role or above crafts an HTTP GET or POST request targeting the exposed GutenKit REST API routes. Because the application fails to validate whether the requester holds administrative or appropriate marketing privileges, the underlying controller processes the request. The application queries the connected marketing account integration and serializes the resulting mailing-list audience metadata directly into the HTTP response body.\nThe vulnerable component involves the plugin's REST API route registration and controller logic responsible for handling marketing service integrations. The exposure is network-based, reachable over standard HTTP/HTTPS protocols via the WordPress REST API namespace. Post-exploitation impact is characterized by the unauthorized extraction of third-party marketing metadata, exposing internal audience segmentation data, subscriber list configurations, and potentially sensitive account identifiers linked to external marketing platforms."
}