What the vulnerability does
01Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
Explanation of Vulnerability in Simple Terms
02Summary
Kirki page builder versions up to 6.0.14 expose sensitive information to unauthenticated attackers over the network. The vulnerability allows reading non-public data without requiring user interaction or special network conditions. No code execution or data modification is possible through this flaw. Update to a version newer than 6.0.14.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the site without authentication.
Potential impact on your site
04Site Impact
Unauthenticated visitors can access non-public data exposed by Kirki.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 24, 2026
CVE published
