CVE-2026-15827: GutenKit Blocks Auth Bypass Vulnerability

CVE-2026-15827 Overview

CVE-2026-15827 is a missing authorization vulnerability in the GutenKit Blocks plugin for WordPress, affecting all versions up to and including 2.4.12. The plugin exposes two REST API endpoints, /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests, that register permission_callback => '__return_true'. Unauthenticated attackers can query these endpoints to retrieve private Mailchimp audience configuration data. The exposed data includes audience lists, merge fields, interest categories, interest names, and subscriber counts. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can enumerate Mailchimp audience metadata from any WordPress site running GutenKit Blocks 2.4.12 or earlier with a configured Mailchimp integration.

Affected Products

GutenKit Blocks plugin for WordPress, versions up to and including 2.4.12
WordPress sites with the GutenKit Mailchimp integration configured
Confirmed vulnerable code paths in tagged releases 2.4.6 and 2.4.11

Discovery Timeline

2026-07-23 - CVE-2026-15827 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15827

Vulnerability Analysis

The GutenKit Blocks plugin registers two WordPress REST API routes for its Mailchimp integration. Both routes are declared with permission_callback => '__return_true', which instructs WordPress to accept every request regardless of authentication or capability. The route handlers read the stored Mailchimp API key from the gutenkit_settings_list option and proxy requests to the Mailchimp API on behalf of the caller.

Because no login check, nonce validation, or capability verification is performed, any anonymous internet user who can reach the site can trigger these calls. The plugin returns the Mailchimp response, containing list identifiers, merge field definitions, interest category structures, interest names, and subscriber-count metadata. The registration logic and callback functions live in includes/Routes/MailChimp.php, referenced in the WordPress plugin repository trac.

Root Cause

The root cause is a broken access control pattern. __return_true is a WordPress helper that unconditionally returns true, which is appropriate only for genuinely public endpoints. Applying it to a handler that reads a stored secret and returns account-scoped data removes every access control layer WordPress provides.

Attack Vector

Exploitation is trivial and requires only network access to the target site. An attacker sends an unauthenticated GET request to /wp-json/gutenkit/v1/mailchimp/get/lists or /wp-json/gutenkit/v1/mailchimp/get/interests. The server responds with the Mailchimp audience metadata proxied through the site's stored API key. No user interaction, session, or privilege is required.

See the Wordfence advisory for CVE-2026-15827 and the WordPress Changeset Report for the fixing changeset.

Detection Methods for CVE-2026-15827

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/gutenkit/v1/mailchimp/get/lists in web server or WAF logs
Unauthenticated HTTP GET requests to /wp-json/gutenkit/v1/mailchimp/get/interests in web server or WAF logs
Requests to the above endpoints originating from IP addresses without a valid WordPress session cookie or nonce header
Spikes of REST API traffic targeting gutenkit/v1/mailchimp/* paths

Detection Strategies

Alert on any request to the two vulnerable REST routes that lacks a X-WP-Nonce header or authenticated session cookie
Track HTTP 200 responses to gutenkit/v1/mailchimp/get/* and flag responses whose bodies contain Mailchimp list identifiers or merge-field schemas
Correlate requests to these endpoints with subsequent access attempts to Mailchimp APIs from unfamiliar IPs

Monitoring Recommendations

Ingest WordPress and reverse-proxy access logs into a SIEM and build queries targeting the gutenkit/v1/mailchimp/ path prefix
Monitor the gutenkit_settings_list option for unexpected reads or modifications by adding audit hooks
Rotate the Mailchimp API key stored in the plugin settings and monitor Mailchimp audit logs for unusual list or campaign queries

How to Mitigate CVE-2026-15827

Immediate Actions Required

Update the GutenKit Blocks plugin to a version later than 2.4.12 that includes the fix referenced in the WordPress changeset 3618270
Rotate the Mailchimp API key configured in GutenKit and revoke the previous key from the Mailchimp account
Review Mailchimp audit logs for unauthorized list, merge-field, or interest queries since the plugin was installed
Block direct external access to /wp-json/gutenkit/v1/mailchimp/* at the WAF or reverse proxy until patching is complete

Patch Information

The vendor addressed the missing authorization in a release after 2.4.12. The applied fix is captured in the WordPress plugin changeset 3618270. The patch replaces the permissive __return_true callback with a capability-checked permission callback on the affected Mailchimp routes.

Workarounds

Deactivate the GutenKit Mailchimp integration if the feature is not required, and clear the stored API key from gutenkit_settings_list
Deploy a WAF rule that returns HTTP 403 for unauthenticated requests to /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests
Restrict access to the WordPress REST API for anonymous users at the network edge where business requirements allow

bash

# Example NGINX rule to block unauthenticated access to the vulnerable endpoints
location ~ ^/wp-json/gutenkit/v1/mailchimp/get/(lists|interests) {
    if ($http_cookie !~ "wordpress_logged_in_") {
        return 403;
    }
}