CVE-2026-112347
Received Received - Intake

Broken Object-Level Access Control in Kirki WordPress Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-112347
EUVD
EUVD-2026-113951

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Themeum Kirki 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki plugin for WordPress before version 6.4.1 has a vulnerability where it fails to properly check user permissions for specific actions. The plugin's page REST API endpoints and handlers do not verify if a user has the correct object-level permissions, only checking a broad role-based access. This allows users with the default Editor role to modify any post's title, slug, or publication status, even if they don't own the post.

Impact Analysis

An attacker with Editor access could change the status of published posts to draft, exposing private content or removing published content. They could also alter post titles or slugs, potentially causing confusion or breaking links. Custom post types and WooCommerce products are also affected, which could disrupt e-commerce functionality or expose sensitive product data.

Compliance Impact

This vulnerability could lead to unauthorized modification or exposure of sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's requirements for protecting health information. Unauthorized changes to published content could result in data breaches or non-compliance with record-keeping standards.

Mitigation Strategies

Update the Kirki plugin to version 6.4.1 or later to address the broken access control flaw. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart