CVE-2026-12122 describes a missing authorization vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The issue affects all versions up to and including 6.0.11. An unauthenticated attacker can exploit the get_single_symbol function by supplying sequential WordPress post IDs to extract sensitive information such as full builder metadata and rendered HTML of kirki_symbol posts, including unpublished drafts. This exposure can lead to leakage of sensitive content that should not be publicly accessible. There is no vendor advisory or patch information currently available to confirm remediation status.

The vulnerability allows unauthenticated attackers to access sensitive information from kirki_symbol posts, including unpublished drafts, which could lead to information disclosure. The CVSS score of 5.3 (medium severity) reflects the network attack vector with low complexity and no privileges required. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin or disable it if possible to prevent exploitation. Monitor official themeum communications for updates on patches or mitigations.