CVE-2026-12122: Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the getsinglesymbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirkisymbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/kirkito a version that resolves this vulnerability.Fixed in 6.0.11 - Compensating control
Restrict unauthenticated access to AJAX endpoints related to kirki_post_apis_nopriv/get_single_symbol (e.g., via web application firewall or network-level access controls) to prevent unauthenticated attackers from extracting builder metadata and rendered HTML.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12122?
The severity of CVE-2026-12122 is classified as medium with a score of 5.3.
How do I fix CVE-2026-12122?
To fix CVE-2026-12122, update the Kirki plugin to version 6.0.12 or later.
What type of vulnerability is CVE-2026-12122?
CVE-2026-12122 is a Sensitive Information Exposure vulnerability affecting unauthenticated users.
Who is affected by CVE-2026-12122?
All users of the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress up to version 6.0.11 are affected by CVE-2026-12122.
What information can be exposed due to CVE-2026-12122?
CVE-2026-12122 allows unauthenticated attackers to extract the full builder metadata.