# Kirki <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Editor Preview Token Dynamic Content and Collection Requests

- **ID:** WPSEC-2026-2980
- **Plugin:** Kirki – Freeform Page Builder, Website Builder & Customizer (`kirki`), https://wordpress.org/plugins/kirki/
- **Affected versions:** from 6.0.0 before 6.4.2
- **Fixed in:** 6.4.2 (Update to 6.4.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kirki
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2980/

## Description

The Kirki plugin for WordPress is vulnerable to Sensitive Information Exposure via the dynamic content and collection AJAX endpoints in all versions up to, and including, 6.4.1, due to missing read-permission checks on the requested post and user IDs, and due to collection queries returning posts of any status along with post passwords and commenter email addresses. This makes it possible for unauthenticated attackers who hold a read-only editor preview link to read fields and meta of private, draft and password-protected posts, other users' profile data, and the email addresses of comment authors. The read-only preview access feature must be enabled and its link shared.

## References

- https://wpsec.com/vuln/WPSEC-2026-2980/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.2/
- https://wordpress.org/plugins/kirki/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2980/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.