CVE-2026-8096
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Authorization bypass vulnerability in the Kirki plugin for WordPress up to version 6.0.6. Allows authenticated attackers with subscriber-level access or higher to view all Kirki frontend forms and read stored visitor submission data, including contact details and messages.
Risk Assessment
Attackers can access sensitive visitor data, compromising privacy and potentially leading to information leakage.
Recommendation
Update the Kirki plugin to the latest available version.
Original NVD description (English source)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.