5.3
Medium
CVE-2026-77754 The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public…
Description
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.0 | earliest → < 6.0.14 | 6.0.14 |
Other CVEs of Kirki
The 15 CVEs of Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Medium
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Medium
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
6.8
Medium
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Medium