CVE-2026-112347 Details
Description
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.
A broken object-level access control vulnerability has been identified in the Kirki WordPress plugin, affecting versions prior to 6.4.1. The vulnerability resides in the page REST API, specifically within the PUT /wp-json/kirki/v1/pages/{page_id} route. The issue arises because the route's handlers—save_page_data, duplicate, and delete in PageController.php—rely solely on a broad role-based access check, failing to implement a per-object WordPress capability verification. This flaw allows users with Kirki edit access, typically granted to the Editor role, to alter the title, slug, and publication status of any non-trashed post across all post types, including custom types and WooCommerce products, regardless of ownership. Exploitation could lead to unauthorized exposure of private or draft content or the removal of published material by manipulating the unregulated post_status field.
Users are advised to update to Kirki version 6.4.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirki | < 6.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | New CVE Received | [email protected] |
| Oct 30, 2026 | CVE Modified | CISA-ADP |