CVE-2024-31245: ConvertKit Information Disclosure Flaw

CVE-2024-31245 Overview

CVE-2024-31245 is an information disclosure vulnerability in the ConvertKit WordPress plugin, an email marketing, newsletter, and landing pages tool. The plugin writes sensitive subscriber email addresses into log files accessible to unauthorized parties. The flaw affects all versions of ConvertKit up to and including 2.4.5. The issue is classified under [CWE-532]: Insertion of Sensitive Information into Log File.

Attackers can retrieve disclosed email data over the network without authentication or user interaction. This enables targeted phishing campaigns and bulk harvesting of subscriber lists from affected WordPress sites.

Critical Impact
Unauthenticated remote attackers can extract subscriber email addresses from exposed log files, enabling subscriber list harvesting and follow-on phishing.

Affected Products

ConvertKit WordPress plugin (Email Marketing, Email Newsletter and Landing Pages) versions up to 2.4.5
WordPress installations running the vulnerable plugin
Sites where plugin log files reside under web-accessible paths

Discovery Timeline

2024-04-10 - CVE-2024-31245 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-31245

Vulnerability Analysis

The ConvertKit plugin records operational events related to subscriber interactions and API activity. During these write operations, the plugin includes subscriber email addresses in plaintext within log entries. Because the log file resides in a predictable location associated with the plugin installation, an unauthenticated remote attacker can request the file directly and parse the email addresses from its contents.

The vulnerability does not require authentication, user interaction, or elevated privileges. It impacts confidentiality only, with no integrity or availability consequences. The recorded data accumulates over time, so long-running installations may leak the entire history of subscriber events.

The attacker model is straightforward: identify a WordPress site running ConvertKit at or below version 2.4.5, request the plugin's log file path, and extract email addresses. Automated scanners can perform this across many sites at scale.

Root Cause

The root cause is improper handling of sensitive data during logging operations [CWE-532]. The plugin writes personally identifiable information into a log file without restricting filesystem access controls or sanitizing the logged fields. There is no .htaccess deny rule, randomized filename, or access check protecting the log artifact from direct HTTP retrieval.

Attack Vector

Exploitation occurs over the network against the WordPress front-end. An attacker issues an HTTP GET request to the known log file path under the plugin directory. If the web server returns the contents, the attacker parses subscriber email addresses for downstream abuse. Refer to the Patchstack Vulnerability Advisory for technical details.

// No verified public exploit code is available.
// The vulnerability is exercised by issuing a direct HTTP GET
// to the plugin's exposed log file and parsing email entries.

Detection Methods for CVE-2024-31245

Indicators of Compromise

Unexpected HTTP GET requests targeting files within the ConvertKit plugin directory, particularly any .log or .txt artifacts
Web server access logs showing repeated requests from a single source enumerating plugin file paths
External services or third parties receiving phishing emails sent to addresses present only in your ConvertKit subscriber list

Detection Strategies

Inventory WordPress installations and identify any running the ConvertKit plugin at version 2.4.5 or earlier
Audit the plugin directory on disk for log files containing email addresses or other subscriber data
Review web server access logs for prior requests that successfully retrieved log files under the plugin path

Monitoring Recommendations

Alert on HTTP 200 responses for requests to file extensions associated with logs under /wp-content/plugins/ paths
Monitor for scanner user agents and high-volume enumeration of WordPress plugin directories
Track subscriber complaints about unsolicited email as a downstream signal of list compromise

How to Mitigate CVE-2024-31245

Immediate Actions Required

Upgrade the ConvertKit WordPress plugin to a version later than 2.4.5
Delete existing plugin log files containing subscriber email addresses from the web server
Review web server logs to determine whether the log file was previously accessed by external parties

Patch Information

ConvertKit addressed the issue in versions released after 2.4.5. Site administrators should apply the latest available plugin update through the WordPress admin dashboard or by replacing the plugin files via SFTP. Confirm the installed version after upgrade by checking the Plugins page. See the Patchstack Vulnerability Advisory for vendor remediation guidance.

Workarounds

Block direct HTTP access to log files in the plugin directory using web server configuration rules
Restrict access to /wp-content/plugins/convertkit/ log artifacts using .htaccess deny directives
Remove or rotate any historical log files that contain subscriber email data

bash

# Apache .htaccess rule to deny direct access to .log files
<FilesMatch "\.log$">
    Require all denied
</FilesMatch>

# Nginx equivalent - add to server block
location ~* \.log$ {
    deny all;
    return 404;
}