CVE-2026-112347
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability…
- Risk score
- 46/100
- CVSS
- 7.6 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without perf…
- Affected
- See advisory
- Fix
- Upgrade the product to 6.4.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.6 high
References
Original description
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.
Last activity 30 Oct 2026. Patch Forecast updates every hour.