{"id":"CVE-2026-112347","kind":"vulnerability","aliases":["CVE-2026-112347"],"related":[],"title":"Kirki WordPress plugin lets editors change any post's status and content","description":"Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.","summary":"Kirki for WordPress before 6.4.1 fails to check ownership on its page REST API, so a user with Kirki edit access can modify any non-trashed post or product they do not own. An attacker can expose private or draft content or unpublish live content by changing the post status.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kirki","package","page-builders","wordpress"],"not_affected_if":["kirki-6.4.1-or-later","no-kirki-installed"],"how_to_check":"- Check the installed Kirki version with `wp plugin get kirki --field=version` or in the WordPress admin under Plugins.\n- Confirm whether the site has users with the Editor role, since Kirki edit access is granted to Editors by default.\n- Look for the route `/wp-json/kirki/v1/pages/` in the site's REST API index at `/wp-json/`.","fix":"- Kirki: update to `6.4.1` or later.","status":"open","published_at":"2026-10-30T14:16:37+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:32:41+00:00","updated_at":"2026-10-30T14:32:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T14:32:41Z","model":"claude-haiku-5-5","output":{"fix":"- Kirki: update to `6.4.1` or later.","reach":"internet","title":"Kirki WordPress plugin lets editors change any post's status and content","impact":"medium","summary":"Kirki for WordPress before 6.4.1 fails to check ownership on its page REST API, so a user with Kirki edit access can modify any non-trashed post or product they do not own. An attacker can expose private or draft content or unpublish live content by changing the post status.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kirki","page-builders"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Editors alter or unpublish any post, exposing drafts and private content","analyst_note":"","how_to_check":"- Check the installed Kirki version with `wp plugin get kirki --field=version` or in the WordPress admin under Plugins.\n- Confirm whether the site has users with the Editor role, since Kirki edit access is granted to Editors by default.\n- Look for the route `/wp-json/kirki/v1/pages/` in the site's REST API index at `/wp-json/`.","plain_action":"","needs_analyst":false,"not_affected_if":["kirki-6.4.1-or-later","no-kirki-installed"],"who_is_affected":"Sites running Kirki before 6.4.1 that have users with edit access through Kirki, which the Editor role gets by default. Any post type is in scope, including custom post types and WooCommerce products. Sites without Kirki, or running 6.4.1 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001113,"input_tokens":4257,"output_tokens":1375,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112347':15A,18A '-2026':14A,17A '/wp-json/kirki/v1/pages':99C '6.4.1':29B,81C 'access':45B,88C,122C,139C 'api':38B,95C 'attack':60B 'broken':84C 'builder':23B 'capabl':132C 'chang':6A,72B 'check':32B,124C,133C 'coars':118C 'contain':82C 'content':12A,66B,70B,184C,188C 'control':89C 'custom':170C 'cve':13A,16A 'data':107C 'default':146C 'delet':110C 'draft':65B,183C 'duplic':108C 'edit':44B,138C 'editor':5A,143C 'exploit':148C 'expos':62B,180C 'fail':30B 'field':195C 'flaw':150C 'grant':140C 'handler':111C 'id':101C 'includ':169C 'kirki':1A,19B,25B,43B,76C,137C 'let':4A 'level':87C 'live':69B 'manipul':190C 'middlewar':123C 'modifi':47B,152C 'non':50B,162C 'non-trash':49B,161C 'object':86C,130C 'object-level':85C 'ownership':33B 'packag':20B 'page':22B,36B,93C,100C,106C 'page-build':21B 'pagecontroller.php':113C 'per':129C 'per-object':128C 'perform':126C 'plugin':3A,77C 'post':8A,52B,74B,164C,167C,171C,193C 'privat':63B,181C 'product':54B,175C 'public':157C 'publish':187C 'put':98C 'reli':114C 'remov':186C 'rest':37B,94C 'role':120C,144C 'role-to-access':119C 'rout':102C 'save':105C 'slug':155C 'status':10A,75B,158C,194C 'titl':154C 'trash':51B,163C 'type':168C,172C 'unpublish':68B 'unrestrict':192C 'user':41B,135C 'vulner':90C 'without':125C 'woocommerc':174C 'wordpress':2A,24B,27B,79C,131C","nicknames":[],"mitigations":[],"who_affected":"Sites running Kirki before 6.4.1 that have users with edit access through Kirki, which the Editor role gets by default. Any post type is in scope, including custom post types and WooCommerce products. Sites without Kirki, or running 6.4.1 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112347","severity":null,"published_at":"2026-10-30T14:16:37+00:00","modified_at":"2026-10-30T14:16:37+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}