CVE-2026-19699 GutenKit CVE debrief

Who should care

WordPress site administrators using the GutenKit plugin, especially those with public-facing sites or sensitive marketing account data, should be aware of this vulnerability and take necessary steps to mitigate it. Site administrators should review and update the plugin to version 2.5.0 or later, restrict access to sensitive REST API endpoints, and monitor for suspicious activity related to Contributor role users.

Technical summary

The GutenKit WordPress plugin before 2.5.0 has insufficient capability checks on certain REST API endpoints, permitting users with Contributor role and above to access mailing-list audience metadata from the site's connected marketing account. This vulnerability may allow unintended access to sensitive data, potentially leading to data breaches or other security incidents. The plugin's insufficient capability checks may allow users with the Contributor role and above to retrieve sensitive information, including mailing-list audience metadata.

Defensive priority

Low-priority defensive review recommended due to limited attack surface.

Recommended defensive actions

• Review and update GutenKit WordPress plugin to version 2.5.0 or later
• Restrict access to sensitive REST API endpoints
• Monitor for suspicious activity related to Contributor role users
• Perform a thorough review of the plugin's configuration and usage
• Verify that all necessary security patches are applied
• Conduct regular security audits to identify potential vulnerabilities
• Implement additional monitoring and logging to detect potential attacks

Evidence notes

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account. Evidence from the NVD and WPScan suggests a capability check issue in the GutenKit WordPress plugin; further review needed to assess affected scope and potential impact. The CVE record was published on 2026-08-20T06:17:13.167Z and has not been modified since then. The NVD entry is currently Deferred. Limited evidence suggests that the plugin's insufficient capability checks may allow unintended access to sensitive data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.