{
 "id": "WPSEC-2026-2980",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2980/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2980/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2980/index.md",
 "title": "Kirki <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Editor Preview Token Dynamic Content and Collection Requests",
 "description": "The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the dynamic content and collection AJAX endpoints in all versions up to, and including, 6.4.1, due to missing read-permission checks on the requested post and user IDs, and due to collection queries returning posts of any status along with post passwords and commenter email addresses. This makes it possible for unauthenticated attackers who hold a read-only editor preview link to read fields and meta of private, draft and password-protected posts, other users' profile data, and the email addresses of comment authors. The read-only preview access feature must be enabled and its link shared.",
 "plugin": {
  "slug": "kirki",
  "name": "Kirki",
  "full_name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "wordpress_org": "https://wordpress.org/plugins/kirki/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kirki/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kirki"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.0.0",
    "from_inclusive": true,
    "to": "6.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.0.0 before 6.4.2"
  ]
 },
 "introduced_in": "6.0.0",
 "fixed_in": "6.4.2",
 "remediation": "Update to 6.4.2 or later.",
 "fix_released": "2026-11-10T08:45:16+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:45.811726+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2980/",
  "https://plugins.svn.wordpress.org/kirki/tags/6.4.2/",
  "https://wordpress.org/plugins/kirki/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kirki",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}