Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-112347Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

High 7.6

In plain English

A high-severity missing authorization in Kirki from Themeum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.

Affected products (as reported)

Vendor	Product	Versions
Themeum	Kirki	0 – before 6.4.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

WordPress Plugin Changelog release-notes, patch
VulnCheck Advisory: Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API third-party-advisory