Authorization Bypass in Kirki Freeform Page Builder for WordPress

CVE-2026-8096

What is CVE-2026-8096?

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a vulnerability that allows unauthorized access to frontend forms. This issue arises from the plugin's failure to adequately verify user permissions for actions related to form handling. As a result, attackers with subscriber-level access or higher can exploit this flaw to access sensitive visitor data, including contact information and submitted messages. This incident highlights the importance of proper authorization checks in plugin development to prevent unauthorized data exposure.

References