Executive brief
Kirki is a popular WordPress page builder customization plugin. A vulnerability allows users with limited editing permissions to modify or resolve collaboration comments left by other users—even on pages they cannot access—by bypassing authorization checks. An administrator who grants editing roles basic page builder access could see those users change the workflow status of comments across the site.
Technical details
The Kirki plugin versions 6.0.0 through 6.2.5 fail to validate user permissions before processing REST API requests to modify collaboration comment status. Specifically, the /kirki/v1/collaboration-comments/resolve, /read, /unread, /read-all, and /resolve-all endpoints do not check whether the authenticated user owns the comment or has access to the associated page. An authenticated user with content-level page builder access can craft PUT requests to change comment state on any post, bypassing ownership and access control checks that are correctly enforced on the delete endpoint. The vulnerability is an Insecure Direct Object Reference (IDOR) requiring authentication and administrative role configuration, but allowing lateral privilege escalation within the plugin's permission model. Version 6.3.0 and later include the necessary authorization and ownership validation.
Affected products
- Kirki Kirki 6.0.0 to 6.2.5
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 6.3.0