Executive brief
GutenKit is a WordPress plugin that integrates with email marketing platforms like Mailchimp. A flaw in its REST API endpoints allows users with basic Contributor-level permissions (typical for content creators) to retrieve sensitive marketing account metadata—such as audience lists, names, and subscriber interest data—that should only be accessible to administrators. This exposes confidential marketing information without requiring elevated privileges.
Technical details
The GutenKit WordPress plugin versions before 2.5.0 fail to properly validate user capabilities on certain REST API endpoints (/gutenkit/v1/mailchimp/get/lists and /gutenkit/v1/mailchimp/get/interests). The vulnerability is classified as improper authorization (CWE-863), where the plugin checks for authentication (presence of a valid WordPress user session and nonce) but not authorization (the user's actual role/permissions). Attackers with Contributor role or higher can send authenticated REST requests to enumerate mailing-list metadata and interest group information from connected Mailchimp accounts. No user interaction or special network conditions are required beyond an attacker obtaining a basic Contributor account. The vulnerability was fixed in version 2.5.0, and the affected versions are 2.4.12 through 2.4.15.
Affected products
- GutenKit GutenKit before 2.5.0
Timeline
- 2026-08-18: disclosed
- 2026-08-20: patched: Fixed in version 2.5.0