Is CVE-2026-8096 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8096 being exploited in the wild.

How severe is CVE-2026-8096?

Medium severity, with a CVSS score of 6.5, published 19 May 2026.

Which products and versions are affected?

Kirki Framework Kirki Customizer Framework Up to and including 6.0.6.

Is there a fix for CVE-2026-8096?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8096 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8096?

Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8096: Kirki WordPress Plugin authorization bypass in AJAX forms

CVE-2026-8096 · Severity: medium · CVSS 6.5 · Published 2026-05-19

The Kirki plugin for WordPress, which is used to build and customize website pages, contains a security flaw that allows unauthorized users to access private information. An attacker with a basic account on the website can bypass security checks to view all site forms and read sensitive data submitted by other visitors, such as contact details and private messages. This could lead to a significant breach of customer privacy and the exposure of personal data.

Technologies: Kirki Framework Kirki Customizer Framework. Vendors: Kirki Framework.

Quick answers

Is CVE-2026-8096 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8096 being exploited in the wild.
How severe is CVE-2026-8096?: Medium severity, with a CVSS score of 6.5, published 19 May 2026.
Which products and versions are affected?: Kirki Framework Kirki Customizer Framework Up to and including 6.0.6.
Is there a fix for CVE-2026-8096?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8096 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8096?: Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Kirki plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 6.0.6. The vulnerability exists within the plugin's AJAX handling logic, specifically in how it verifies user permissions before granting access to form data. An authenticated attacker with subscriber-level privileges or higher can exploit this flaw via network requests to view frontend forms and extract stored visitor submission data. This data includes contact details, messages, and any other information provided through the site's forms. A patch has been identified in recent changesets to address the improper authorization verification.

Affected products

Kirki Kirki – Freeform Page Builder, Website Builder & Customizer Up to and including 6.0.6

Timeline

2026-05-19: disclosed: Initial publication of the CVE record.
2026-05-19: advisory: Wordfence published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.