Kirki <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Editor Preview Token Dynamic Content and Collection Requests
- ID
- WPSEC-2026-2980
- Plugin
- Kirki – Freeform Page Builder, Website Builder & Customizer (kirki)
- Affected
- from 6.0.0 before 6.4.2
- Remediation
- Update to 6.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Kirki on WPSec AttackSurface
- Fix released
- Published
Description
The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the dynamic content and collection AJAX endpoints in all versions up to, and including, 6.4.1, due to missing read-permission checks on the requested post and user IDs, and due to collection queries returning posts of any status along with post passwords and commenter email addresses. This makes it possible for unauthenticated attackers who hold a read-only editor preview link to read fields and meta of private, draft and password-protected posts, other users' profile data, and the email addresses of comment authors. The read-only preview access feature must be enabled and its link shared.
References
- https://wpsec.com/vuln/WPSEC-2026-2980/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.2/
- https://wordpress.org/plugins/kirki/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS