CVE-2026-15827 MEDIUM

CVE-2026-15827: GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

Vendor Ataurr
Product GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
Weakness CWE-862 · Missing authorization
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permission_callback => '__return_true', and their callbacks read the site's stored Mailchimp API key from the gutenkit_settings_list option and proxy Mailchimp audience/list, merge-field, interest-category, interest-name, and subscriber-count metadata back to the caller with no login, nonce, or capability check. This makes it possible for unauthenticated attackers to retrieve private Mailchimp audience configuration information from any site that has configured the GutenKit Mailchimp integration.

Explanation of Vulnerability in Simple Terms

02Summary

GutenKit versions up to 2.4.12 lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. The vulnerability affects the page builder plugin for WordPress's Gutenberg editor. No user interaction is required to exploit this issue. Site administrators should update to a version newer than 2.4.12.

What an attacker can do

03Attacker Capabilities

Read sensitive data without logging in to the site.

Potential impact on your site

04Site Impact

Unauthorized visitors can access non-public information exposed by the plugin.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-57367 WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability CVE-2026-65469 WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability CVE-2026-8616 Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action CVE-2026-25427 WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability CVE-2026-27377 WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability