Read the docs
TI-2026-83096 Aliases CVE-2026-112347GHSA-xmxv-2997-276g

Broken object-level access control in Kirki WordPress plugin page API

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Kirki plugin for WordPress before 6.4.1 has a broken object-level access control flaw in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and its save_page_data, duplicate, and delete handlers check only the user's role and not each post's capabilities (CWE-862). A user with Kirki edit access, which the Editor role has by default, can change the title, slug, and publication status of any non-trashed post of any post type that they do not own, exposing private or draft content or removing published content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix Fixed Kirki (Themeum): 6.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
themeumKirkibefore 6.4.16.4.1Patch availableCNA
  • Kirki Vendorthemeum Affected before 6.4.1 Fixed in 6.4.1 Patch available CNA

Remediation

Update Kirki to version 6.4.1 or later, which is the fixed version for the affected range from 0 before 6.4.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Kirki (Themeum) Fixed in 6.4.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-112347
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-xmxv-2997-276g

References

Patch 1

  • TI-2024-09629 Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter CVSS 3.1HIGH 7.5
  • TI-2023-02936 Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API CVSS 3.1HIGH 7.5
  • TI-2021-07196 Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending CVSS 3.1HIGH 7.5
  • TI-2023-05666 WP Crowdfunding < 2.1.9 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-00225 Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-04422 Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences