CVE-2026-77754
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Kirki WordPress plugin before version 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Risk Assessment
The organization may experience a breach of user data privacy and disclosure of non-public content, potentially leading to legal consequences and loss of trust. The attack does not require authentication, increasing the risk of exploitation.
Recommendation
It is recommended to update the Kirki plugin to version 6.0.14 or later, which includes fixes for capability checks in AJAX actions.
Other vulnerabilities in Kirki
See all- CVE-2026-57680Medium
The Kirki plugin version 6.0.11 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access protected resources or data without authentication.
- CVE-2026-13147Critical
The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- CVE-2026-57726Critical
The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.
- CVE-2026-57724Critical
The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.
- CVE-2026-74992Medium
The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.
- CVE-2026-66629High
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-18347Medium
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress up to version 6.1.1 is vulnerable to authorization bypass, allowing authenticated attackers with custom-level access to read arbitrary user metadata and sensitive user record fields, including email address, roles, registration date, and user_meta values, belonging to any user including administrators.
- CVE-2026-17604Medium
The Kirki plugin for WordPress up to version 6.1.1 is vulnerable to Directory Traversal via the 'data' parameter. Authenticated attackers with editor-level access and above can read arbitrary files on the server, including sensitive information, by bypassing the strpos()-based guard with traversal sequences in the URL.
- CVE-2026-16747Medium
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
- CVE-2026-16974Medium
The Kirki plugin for WordPress (up to version 6.2.0) is vulnerable to Stored Cross-Site Scripting via the post_meta shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts.
Original NVD description (English source)
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.