# Kirki <= 6.4.0 - Authenticated (Author+) Missing Authorization to Arbitrary Page Modification and Unpublished Content Access

- **ID:** WPSEC-2026-1932
- **Plugin:** Kirki – Freeform Page Builder, Website Builder & Customizer (`kirki`), https://wordpress.org/plugins/kirki/
- **Affected versions:** from 6.3.2 before 6.4.1
- **Fixed in:** 6.4.1 (Update to 6.4.1 or later.)
- **Severity:** High 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kirki
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1932/

## Description

The Kirki plugin for WordPress is vulnerable to unauthorized modification and access of data via the page, popup and symbol editor APIs in all versions up to, and including, 6.4.0, due to missing per-post capability checks (edit_post, read_post) in the page and popup REST endpoints, which only verified that the target post existed, and to the symbol update AJAX action accepting any post ID instead of only symbols. Authors have Kirki builder content access by default. This makes it possible for authenticated attackers with author-level access and above to overwrite the builder content of arbitrary pages and posts belonging to other users, change their title, slug and status, modify popups, and read the unpublished staged builder content and version lists of other users' pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1932/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.1/
- https://wordpress.org/plugins/kirki/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1932/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.