If players have access to all the kits, this may have different reasons.
The player has the permission
In order to get a kit, a player must either have the permission sw.kit.all or sw.kit.[kitname].
PointsAPI is not installed
It often happens that server administrators forget to install PointsAPI. This plugin manages points that players can earn in different games. If this is not installed, all players are granted access to all kits.
Free kit
Free kits are accessible for all players and do not need to be bought separately.
Kit already bought
When an kit is bought, the data will be stored in the configured data memory. This can be either MySQL or a local storage file. If there are the corresponding entries, the player is granted access to the kit. This can happen either by a normal purchase or by manually editing the data memory.