# Kirki <= 6.4.0 - Unauthenticated Sensitive Information Exposure of Unpublished Staged Content via Collection Endpoint

- **ID:** WPSEC-2026-1933
- **Plugin:** Kirki – Freeform Page Builder, Website Builder & Customizer (`kirki`), https://wordpress.org/plugins/kirki/
- **Affected versions:** all versions before 6.4.1
- **Fixed in:** 6.4.1 (Update to 6.4.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kirki
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1933/

## Description

The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the frontend collection REST endpoint in all versions up to, and including, 6.4.0, due to the endpoint loading the most recent version of a page's builder data, which may be an unpublished staged version, without requiring a valid staging preview nonce. This makes it possible for unauthenticated attackers to retrieve rendered content from unpublished staged versions of publicly readable pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1933/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.1/
- https://wordpress.org/plugins/kirki/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1933/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.