CVE-2026-105421: Missing Authorization in Kit Kit (formerly ConvertKit) for WooCommerce

The vulnerability identified as CVE-2026-105421 involves missing authorization controls in Kit (formerly ConvertKit) for WooCommerce plugin versions before 2.2.1. This security issue arises from incorrectly configured access control mechanisms, which may permit unauthorized users to perform actions that should require proper authorization. The CVSS 3.1 base score is 5.3, indicating a medium severity level, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact.

An attacker can exploit the missing authorization to perform unauthorized actions that could alter data or system state, impacting the integrity of the affected system. There is no impact on confidentiality or availability reported. The medium severity reflects the potential for limited but meaningful unauthorized changes within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the input data, users should monitor for updates from Kit (formerly ConvertKit) and apply any official fixes once available. Until then, consider restricting access to the affected plugin features to trusted users only.