# CVE-2026-19699: GutenKit WordPress plugin insufficient capability check in REST API

Source: https://junglewise.ai/threats/cve-2026-19699-gutenkit-wordpress-plugin-insufficient-capability-check-in-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19699 · Severity: low · CVSS 2.7 · Published 2026-08-20

GutenKit is a WordPress plugin that integrates with email marketing platforms like Mailchimp. A flaw in its REST API endpoints allows users with basic Contributor-level permissions (typical for content creators) to retrieve sensitive marketing account metadata—such as audience lists, names, and subscriber interest data—that should only be accessible to administrators. This exposes confidential marketing information without requiring elevated privileges.

## Quick answers

**Is CVE-2026-19699 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19699 being exploited in the wild.

**How severe is CVE-2026-19699?** Low severity, with a CVSS score of 2.7, published 20 August 2026.

**Which products and versions are affected?** GutenKit GutenKit before 2.5.0.

**Is there a fix for CVE-2026-19699?** A patch was published on 2026-08-20: Fixed in version 2.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19699 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19699?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GutenKit WordPress plugin versions before 2.5.0 fail to properly validate user capabilities on certain REST API endpoints (/gutenkit/v1/mailchimp/get/lists and /gutenkit/v1/mailchimp/get/interests). The vulnerability is classified as improper authorization (CWE-863), where the plugin checks for authentication (presence of a valid WordPress user session and nonce) but not authorization (the user's actual role/permissions). Attackers with Contributor role or higher can send authenticated REST requests to enumerate mailing-list metadata and interest group information from connected Mailchimp accounts. No user interaction or special network conditions are required beyond an attacker obtaining a basic Contributor account. The vulnerability was fixed in version 2.5.0, and the affected versions are 2.4.12 through 2.4.15.

## Affected products

- GutenKit GutenKit before 2.5.0

## Timeline

- 2026-08-18: disclosed
- 2026-08-20: patched: Fixed in version 2.5.0

## References

- [https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/](https://wpscan.com/vulnerability/301f10fd-ac72-4d80-8ca3-402a4a55ba3d/)