CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Explanation of Vulnerability in Simple Terms
Kirki Page Builder versions up to 6.0.11 lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 6.0.11 to prevent unauthorized data exposure.
What an attacker can do
Read sensitive information without logging in.
Potential impact on your site
Unauthenticated visitors can access data they shouldn't see, potentially exposing site configuration or user information.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
