CVE-2026-77754
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Kirki WordPress plugin before version 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Risk Assessment
The organization may experience a breach of user data privacy and disclosure of non-public content, potentially leading to legal consequences and loss of trust. The attack does not require authentication, increasing the risk of exploitation.
Recommendation
It is recommended to update the Kirki plugin to version 6.0.14 or later, which includes fixes for capability checks in AJAX actions.
Other vulnerabilities in Kirki
See all- CVE-2026-57680Medium
The Kirki plugin version 6.0.11 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access protected resources or data without authentication.
- CVE-2026-13147Critical
The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- CVE-2026-57726Critical
The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.
- CVE-2026-57724Critical
The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.
- CVE-2026-102291Medium
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This is due to the plugin substituting a user's display_name into the composed page markup unfiltered and then running the whole result through do_shortcode().
- CVE-2026-103065High
Improper validation of specified quantity in input in Kirki up to version 6.3.1. Allows accessing functionality not properly constrained by ACLs.
- CVE-2026-84225Low
The Kirki WordPress plugin before version 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
- CVE-2026-84221Medium
The Kirki WordPress plugin before version 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
- CVE-2026-74992Medium
The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.
- CVE-2026-66629High
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
Original NVD description (English source)
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS