CVE-2026-84222
Received Received - Intake

Kirki Plugin Page Content Exposure Vulnerability

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-84222
EUVD
EUVD-2026-74716

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aristath kirki From 6.2.1 (inc) to 6.2.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Kirki WordPress plugin before version 6.3.0 allows unauthenticated users to access restricted page content. The plugin fails to verify if a requester has permission to read a post before displaying its content, potentially exposing private, draft, pending, or trashed pages.

Detection Guidance

To detect this vulnerability, check if your Kirki WordPress plugin version is below 6.3.0. You can use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version information. Test by attempting to access non-public pages as an unauthenticated user to see if content is exposed.

  • Use WordPress CLI: wp plugin list to check Kirki plugin version.
  • Inspect plugin files for version details in the plugin directory.
  • Manually test by accessing private, draft, or trashed pages without authentication.
Impact Analysis

Unauthenticated users could retrieve sensitive or unpublished content from your WordPress site, leading to data leaks. This may expose confidential information, internal drafts, or pending content that was not intended for public view.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing protected or sensitive data to unauthorized individuals. Unauthorized access to private content may result in legal penalties or breaches of confidentiality obligations.

Mitigation Strategies

Immediately update the Kirki plugin to version 6.3.0 or later. If updating is not possible, consider temporarily disabling the plugin until a patch is applied. Review page permissions to ensure sensitive content is not exposed to unauthorized users.

  • Update Kirki plugin to version 6.3.0 or higher.
  • Disable the plugin temporarily if an update is not immediately available.
  • Audit page permissions to confirm non-public content remains inaccessible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart