CVE-2026-15827 json
GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
published 2026-07-23 3 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-47926
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permission_callback => '__return_true', and their callbacks read the site's stored Mailchimp API key from the gutenkit_settings_list option and proxy Mailchimp audience/list, merge-field, interest-category, interest-name, and subscriber-count metadata back to the caller with no login, nonce, or capability check. This makes it possible for unauthenticated attackers to retrieve private Mailchimp audience configuration information from any site that has configured the GutenKit Mailchimp integration.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/7430594c-3a71-4b24-875b-014e03be868f?source=cve
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.11/includes/Routes/MailChimp.php#L141
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.11/includes/Routes/MailChimp.php#L62
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.11/includes/Routes/MailChimp.php#L17
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.11/includes/Routes/MailChimp.php#L43
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.6/includes/Routes/MailChimp.php#L141
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.6/includes/Routes/MailChimp.php#L62
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.6/includes/Routes/MailChimp.php#L17
- plugins.trac.wordpress.org /browser/gutenkit-blocks-addon/tags/2.4.6/includes/Routes/MailChimp.php#L43
- plugins.trac.wordpress.org /changeset?reponame=&old=3618270%40gutenkit-blocks-addon&new=3618270%40gutenkit-blocks-addon
Sources
- CVE List CVE-2026-15827
- NVD CVE-2026-15827
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.