CVE-2026-13464
Received Received - Intake

Insecure Direct Object Reference in Kirki Plugin Exposes WordPress Post Content

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-13464
EUVD
EUVD-2026-48463

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
devinsays kirki to 6.0.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki plugin for WordPress has an Insecure Direct Object Reference vulnerability due to missing validation on the 'context' parameter. This allows unauthenticated attackers to read sensitive post data by supplying an arbitrary post ID and an attacker-controlled block template.

Detection Guidance

To detect this vulnerability, check WordPress sites using the Kirki plugin up to version 6.0.14. Test by accessing URLs with the 'context' parameter and arbitrary post IDs to see if unauthorized post data is exposed. Use tools like curl to send requests such as: curl 'https://example.com/wp-json/kirki/v1/template?context=any_post_id_here' and inspect responses for sensitive data.

Impact Analysis

Attackers could access private, draft, or password-protected posts, potentially exposing sensitive information like titles, content, and excerpts. This could lead to data leaks or unauthorized access to confidential content.

Compliance Impact

This vulnerability could violate compliance requirements by exposing protected data. GDPR may require breach notification, while HIPAA could face penalties for unauthorized access to sensitive health information.

Mitigation Strategies

Immediately update the Kirki plugin to the latest version beyond 6.0.14. If an update is unavailable, disable or remove the plugin until a patch is released. Review server logs for suspicious requests targeting the 'context' parameter. Implement a web application firewall to block exploit attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart