Kirki <= 6.4.0 - Authenticated (Author+) Missing Authorization to Arbitrary Page Modification and Unpublished Content Access
- ID
- WPSEC-2026-1932
- Plugin
- Kirki – Freeform Page Builder, Website Builder & Customizer (kirki)
- Affected
- from 6.3.2 before 6.4.1
- Remediation
- Update to 6.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- Kirki on WPSec AttackSurface
- Fix released
- Published
Description
The Kirki plugin for WordPress is vulnerable to unauthorized modification and access of data via the page, popup and symbol editor APIs in all versions up to, and including, 6.4.0, due to missing per-post capability checks (edit_post, read_post) in the page and popup REST endpoints, which only verified that the target post existed, and to the symbol update AJAX action accepting any post ID instead of only symbols. Authors have Kirki builder content access by default. This makes it possible for authenticated attackers with author-level access and above to overwrite the builder content of arbitrary pages and posts belonging to other users, change their title, slug and status, modify popups, and read the unpublished staged builder content and version lists of other users' pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1932/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.1/
- https://wordpress.org/plugins/kirki/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS