Threats tagged 'ghsa-xmxv-2997-276g'

The Kirki plugin for WordPress versions prior to 6.4.1 has a broken object-level access control vulnerability in its page REST API. This flaw allows users with Kirki edit access, typically granted to the Editor role, to modify titles, slugs, and publication statuses of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the API relies only on a coarse role-based access check without verifying per-object WordPress capabilities. Exploitation can expose private or draft content or remove published content by manipulating the post_status field.