CVE-2026-84225
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Kirki WordPress plugin before version 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
Risk Assessment
Unauthorized modification of comments can lead to data integrity issues, disruption of collaboration, or privilege escalation within content.
Recommendation
Update the Kirki plugin to version 6.3.0 or later, which includes a fix for comment permission checks.
Other vulnerabilities in Kirki
See all- CVE-2026-57680Medium
The Kirki plugin version 6.0.11 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access protected resources or data without authentication.
- CVE-2026-13147Critical
The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- CVE-2026-57726Critical
The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.
- CVE-2026-57724Critical
The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.
- CVE-2026-84221Medium
The Kirki WordPress plugin before version 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
- CVE-2026-77754Medium
The Kirki WordPress plugin before version 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
- CVE-2026-74992Medium
The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.
- CVE-2026-66629High
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-18347Medium
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress up to version 6.1.1 is vulnerable to authorization bypass, allowing authenticated attackers with custom-level access to read arbitrary user metadata and sensitive user record fields, including email address, roles, registration date, and user_meta values, belonging to any user including administrators.
- CVE-2026-17604Medium
The Kirki plugin for WordPress up to version 6.1.1 is vulnerable to Directory Traversal via the 'data' parameter. Authenticated attackers with editor-level access and above can read arbitrary files on the server, including sensitive information, by bypassing the strpos()-based guard with traversal sequences in the URL.
Original NVD description (English source)
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.