CVE-2026-16974

The Kirki plugin version 6.0.11 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access protected resources or data without authentication.

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.

The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This is due to the plugin substituting a user's display_name into the composed page markup unfiltered and then running the whole result through do_shortcode().

Improper validation of specified quantity in input in Kirki up to version 6.3.1. Allows accessing functionality not properly constrained by ACLs.

The Kirki WordPress plugin before version 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.

The Kirki WordPress plugin before version 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.

The Kirki WordPress plugin before version 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.

The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.