CVE-2026-84222: CWE-200 Information Exposure in Kirki
Affects KirkiSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
AI-suggested
No official patch or remediation guidance is currently confirmed. Users should upgrade to Kirki version 6.3.0 or later once available, as the vulnerability affects versions before 6.3.0. Until then, restrict access to the plugin or implement additional access controls at the server or WordPress level to prevent unauthorized content retrieval. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Kirki | Affected
| Fixed in
|
Description
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.