Vulnerabilities / Kirki / WPSEC-2026-1933
Kirki <= 6.4.0 - Unauthenticated Sensitive Information Exposure of Unpublished Staged Content via Collection Endpoint
Medium 5.3
CWE-200Fixed in 6.4.1
- ID
- WPSEC-2026-1933
- Plugin
- Kirki – Freeform Page Builder, Website Builder & Customizer (kirki)
- Affected
- all versions before 6.4.1
- Remediation
- Update to 6.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Kirki on WPSec AttackSurface
- Fix released
- Published
Description
The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the frontend collection REST endpoint in all versions up to, and including, 6.4.0, due to the endpoint loading the most recent version of a page's builder data, which may be an unpublished staged version, without requiring a valid staging preview nonce. This makes it possible for unauthenticated attackers to retrieve rendered content from unpublished staged versions of publicly readable pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1933/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.1/
- https://wordpress.org/plugins/kirki/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS