CVE-2026-8096 describes an authorization bypass vulnerability (CWE-862) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The plugin fails to properly verify user authorization for certain actions, allowing authenticated users with subscriber-level privileges or above to access all Kirki frontend forms and read sensitive visitor-submitted data. This affects all versions up to and including 6.0.6. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. No patch or official remediation level has been provided by the vendor as of the published date.

Authenticated users with subscriber-level access or higher can bypass authorization controls to view all frontend forms created by the Kirki plugin and access stored visitor form submission data. This includes sensitive information such as contact details and messages submitted by visitors. The vulnerability impacts data confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user access where possible and monitor for plugin updates from themeum. Avoid granting unnecessary privileges to users and consider disabling the Kirki plugin if sensitive visitor data exposure is a concern.