# CVE-2026-84222: Kirki plugin unauthenticated non-public post content disclosure

Source: https://junglewise.ai/threats/cve-2026-84222-kirki-plugin-unauthenticated-non-public-post-content-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84222 · Severity: medium · CVSS 5.3 · Published 2026-09-09

The Kirki WordPress plugin is a page builder tool that allows administrators to design website layouts. Before version 6.3.0, the plugin failed to properly verify user permissions when retrieving page content, allowing unauthenticated visitors to read private, draft, pending, or trashed pages that should not be publicly visible. An attacker could exploit this to access sensitive content that was intended to be confidential.

## Quick answers

**Is CVE-2026-84222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84222 being exploited in the wild.

**How severe is CVE-2026-84222?** Medium severity, with a CVSS score of 5.3, published 9 September 2026.

**Which products and versions are affected?** Kirki Kirki 6.2.1 through 6.2.5.

**Is there a fix for CVE-2026-84222?** A patch was published on 2026-09-09: Fixed in version 6.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84222 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84222?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the Kirki plugin's REST API endpoint /wp-json/kirki/v1/frontend/collection. The plugin accepts a kirki_data parameter containing a nested post_id field but only validates permissions against top-level parameters (post_id and context), not the nested post_id value used to actually load and render content. This allows unauthenticated attackers to request restricted posts via the nested parameter and receive fully rendered page markup, bypassing WordPress's standard permission checks. The vulnerability affects versions 6.2.1 through 6.2.5 and was fixed in version 6.3.0. No authentication or user interaction is required for exploitation.

## Affected products

- Kirki Kirki 6.2.1 through 6.2.5

## Timeline

- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 6.3.0

## References

- [https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf/](https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf/)