CVE-2026-112347: Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{pageid} route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted poststatus field.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kirki WordPress Pluginto a version that resolves this vulnerability.Fixed in 6.4.1
Event History
Frequently Asked Questions
Who can exploit this issue in a typical installation?
Any authenticated user with Kirki edit access can exploit it. The Editor role has this access by default, so Editors are exposed even when they do not own the targeted content.
What content can an attacker alter?
The vulnerable API can be used to change the title, slug, and publication status of any non-trashed post, including custom post types and WooCommerce products. This can expose private or draft content or remove published content by changing its status.
Does the attacker need to know or own the target post?
The attacker does not need to own the target post. The affected route lacks a per-object WordPress capability check, allowing access to eligible posts across post types.
What versions are affected?
Kirki versions before 6.4.1 are affected. Updating to version 6.4.1 or later addresses the reported vulnerable version range.
What can be done if updating is not immediately possible?
Restrict Kirki edit access, particularly for Editor-role users, to prevent users from reaching the vulnerable functionality. Review changes to titles, slugs, and publication statuses of non-trashed posts for unauthorized modifications.