CVE-2026-84225: Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has been granted content-level access to the page builder by an administrator can exploit it. The user may be able to modify collaboration comments left by other users, including comments on pages they cannot open.
Which versions are affected?
Kirki versions 6.0.0 through 6.2.5 are affected. The issue is addressed in version 6.3.0.
What access does an attacker need?
The attacker needs an authenticated account with administrator-granted content-level access to the page builder. No unauthenticated attack path is described.