Broken Object-Level Access Control in Kirki Plugin for WordPress

CVE-2026-112347

What is CVE-2026-112347?

The Kirki plugin for WordPress prior to version 6.4.1 contains a vulnerability related to broken object-level access control in its page REST API. The flaw exists within the PUT /wp-json/kirki/v1/pages/{page_id} endpoint, where the access control relies solely on a broad role-to-access middleware check rather than a detailed WordPress capability check for each object. This allows users assigned Kirki edit access, typically granted to the Editor role, to exploit this vulnerability and alter the title, slug, and publication status of any non-trashed post across various post types—including custom post types and WooCommerce products. Consequently, this could result in unauthorized exposure of private or draft content and the alteration or removal of published posts by manipulating the unrestricted post_status field.

References