CVE-2026-84222 — Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

CVE-2026-84222

Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter PUBLISHED

Description (CNA)

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.

Affected (CNA)

Vendor / product	Versions
Unknown / Kirki	affected 6.2.1 before 6.3.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.