Junglewise Threat Intelligence

CVE-2026-15827: ataurr GutenKit Blocks missing authorization in Mailchimp API endpoints

CVE-2026-15827 · Severity: medium · CVSS 5.3 · Published 2026-07-23

Technologies: Ataurr GutenKit. Vendors: Ataurr.

Executive brief

The GutenKit Blocks plugin for WordPress, which provides design tools for the Gutenberg editor, contains a security flaw that allows unauthorized access to Mailchimp integration data. An attacker can remotely view private information about your Mailchimp mailing lists, including subscriber counts and interest categories, without needing to log in. This could lead to the exposure of sensitive marketing configuration and audience metadata.

Technical details

The GutenKit Blocks plugin for WordPress is vulnerable to a missing authorization check (CWE-862) within its REST API implementation. Specifically, the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests endpoints are registered with 'permission_callback' set to '__return_true'. This configuration allows any unauthenticated user to trigger the callbacks, which retrieve the site's stored Mailchimp API key and proxy sensitive metadata—including audience lists, merge fields, and subscriber counts—back to the requester. The vulnerability affects all versions up to and including 2.4.12.

Affected products

  • ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.12

Timeline

  • 2026-07-23: disclosed: Initial disclosure by Wordfence and NVD publication.

References