{
 "id": "WPSEC-2026-1933",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1933/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1933/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1933/index.md",
 "title": "Kirki <= 6.4.0 - Unauthenticated Sensitive Information Exposure of Unpublished Staged Content via Collection Endpoint",
 "description": "The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the frontend collection REST endpoint in all versions up to, and including, 6.4.0, due to the endpoint loading the most recent version of a page's builder data, which may be an unpublished staged version, without requiring a valid staging preview nonce. This makes it possible for unauthenticated attackers to retrieve rendered content from unpublished staged versions of publicly readable pages.",
 "plugin": {
  "slug": "kirki",
  "name": "Kirki",
  "full_name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "wordpress_org": "https://wordpress.org/plugins/kirki/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kirki/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kirki"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.4.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.4.1",
 "remediation": "Update to 6.4.1 or later.",
 "fix_released": "2026-10-28T08:36:24+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:40.304666+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1933/",
  "https://plugins.svn.wordpress.org/kirki/tags/6.4.1/",
  "https://wordpress.org/plugins/kirki/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kirki",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}