Auth bypass in Themeum Kirki
CVE-2026-112347
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- wordpress.org/plugins/kirki/ (release-notes, patch)
- www.vulncheck.com/advisories/kirki-wordpress-plugin-broken-object-level-access-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-112347?
- CVE-2026-112347 is a high-severity vulnerability in Themeum Kirki, classified under Missing Authorization. CVSS score: 7.6/10. Published 2026-10-30.
- How severe is CVE-2026-112347?
- High severity. CVSS v3 base score is 7.6 out of 10.