7.2
High
CVE-2026-112347 Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…
Description
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.4 | earliest → < 6.4.1 | 6.4.1 |
Other CVEs of Kirki
The 12 CVEs of Kirki →
CVE-2026-112348
Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
6.9
Medium
CVE-2026-42694
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki…
4.3
Medium
CVE-2026-103065
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality…
8.2
High
CVE-2026-66629
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions
7.1
High