The ConvertKit plugin for WordPress suffers from a missing capability check in its tag_subscriber function, allowing unauthenticated attackers to subscribe users to tags without proper authorization. This vulnerability affects all versions up to and including 2.4.9. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. There is no vendor-provided patch or advisory linked, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized modification of subscriber tags, which may lead to unintended subscription changes. While it does not compromise confidentiality or availability, it can cause integrity issues and potentially lead to financial damage if the API quota is exceeded due to unauthorized subscriptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and monitor for unusual subscription activity to mitigate potential abuse.