CVE-2026-13464 describes an Insecure Direct Object Reference vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The vulnerability is due to lack of validation on the 'context' parameter, which is user-controlled. This allows unauthenticated attackers to bypass authorization controls and access sensitive post data across all affected versions up to and including 6.0.14. The attack vector involves supplying an arbitrary post ID via the 'context' parameter alongside a crafted block template, enabling unauthorized reading of post titles, content, and excerpts regardless of post status or author.

An unauthenticated attacker can read sensitive content from any WordPress post, including unpublished drafts, pending posts, private posts, password-protected posts, and trashed posts. This leads to unauthorized disclosure of potentially sensitive or confidential information. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, consider restricting access to the plugin or disabling it if possible to prevent exploitation.