Executive brief
The Kirki plugin for WordPress, which is used to build and customize website pages, contains a security flaw that allows unauthorized users to access private information. An attacker with a basic account on the website can bypass security checks to view all site forms and read sensitive data submitted by other visitors, such as contact details and private messages. This could lead to a significant breach of customer privacy and the exposure of personal data.
Technical details
The Kirki plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 6.0.6. The vulnerability exists within the plugin's AJAX handling logic, specifically in how it verifies user permissions before granting access to form data. An authenticated attacker with subscriber-level privileges or higher can exploit this flaw via network requests to view frontend forms and extract stored visitor submission data. This data includes contact details, messages, and any other information provided through the site's forms. A patch has been identified in recent changesets to address the improper authorization verification.
Affected products
- Kirki Kirki – Freeform Page Builder, Website Builder & Customizer Up to and including 6.0.6
Timeline
- 2026-05-19: disclosed: Initial publication of the CVE record.
- 2026-05-19: advisory: Wordfence published the vulnerability details.