CVE-2026-13464 is an insecure direct object reference vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The issue exists due to lack of validation on the 'context' parameter, which is user-controlled. This allows unauthenticated attackers to bypass authorization controls and access sensitive post data, including unpublished and protected posts, by specifying arbitrary post IDs. The vulnerability affects all versions up to and including 6.0.14. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

An unauthenticated attacker can read sensitive content from any WordPress post on a site using the vulnerable plugin, including drafts, pending, private, password-protected, and trashed posts. This exposure can lead to information disclosure without requiring authentication or user interaction. The integrity and availability of the system are not impacted by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin or disabling it if possible to prevent exploitation. Monitor for vendor updates regarding patches or official mitigations.