blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-112347

HIGH 7.2 CVSS 4.0
Published
October 30, 2026
Last modified
October 30, 2026
NVD status
Deferred
Reported by
disclosure@vulncheck.com
Weakness
CWE-862
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.

Affected WordPress components

  • Kirki – Freeform Page Builder, Website Builder & Customizer Plugin · kirki
    Confirmed match Active
    Before 6.4.1
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Themeum Kirki — Before 6.4.1

References

  • wordpress.org https://wordpress.org/plugins/kirki/#developers
  • www.vulncheck.com https://www.vulncheck.com/advisories/kirki-wordpress-plugin-broken-object-level-access-control-via-page-api
  • nvd.nist.gov Official NVD record