Improper Access Control in Kirki WordPress Plugin
CVE-2026-84222
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84222?
The Kirki WordPress plugin, prior to version 6.3.0, contains a vulnerability that allows unauthenticated users to access private content. This issue arises because the plugin fails to verify whether a requester is authorized to view certain pages, including those marked as private, draft, or trashed. This oversight can lead to unauthorized exposure of sensitive information and presents a significant risk to site owners who rely on the plugin for managing content visibility.
Affected Version(s)
Kirki 6.2.1 < 6.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.