CVE-2026-15827

Name of the Vulnerable Software and Affected Versions GutenKit Blocks versions prior to 2.4.13

Description The plugin allows unauthorized access to data because it fails to perform capability checks on the '/wp-json/gutenkit/v1/mailchimp/get/lists' and '/wp-json/gutenkit/v1/mailchimp/get/interests' REST API endpoints. These endpoints use a permission callback set to return true, which allows unauthenticated users to bypass login, nonce, or capability requirements. The system retrieves the Mailchimp API key from the gutenkit settings list option and returns sensitive metadata, including audience lists, merge-fields, interest-categories, interest-names, and subscriber counts, to the requester.

Recommendations Update the plugin to a version later than 2.4.12. As a temporary mitigation, restrict access to the '/wp-json/gutenkit/v1/mailchimp/get/lists' and '/wp-json/gutenkit/v1/mailchimp/get/interests' endpoints.