CVE-2026-12122: Kirki WordPress Information Disclosure

CVE-2026-12122 Overview

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a broken access control flaw affecting all versions up to and including 6.0.11. The vulnerability resides in the get_single_symbol function, which fails to verify caller permissions before returning kirki_symbol post data. Unauthenticated attackers can iterate sequential WordPress post IDs to extract full builder metadata and rendered HTML from any symbol post, including unpublished drafts. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
Remote, unauthenticated attackers can enumerate and exfiltrate private symbol content, exposing draft designs, internal branding assets, and potentially sensitive markup on affected WordPress sites.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All versions up to and including 6.0.11
WordPress sites exposing the plugin's AJAX symbol endpoint

Discovery Timeline

2026-07-02 - CVE-2026-12122 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-12122

Vulnerability Analysis

The Kirki plugin registers an AJAX action that dispatches to the get_single_symbol handler in includes/Ajax/Symbol.php. The handler accepts a post ID from the request, loads the corresponding kirki_symbol custom post type, and returns its stored builder metadata alongside the rendered HTML output. The handler performs no capability check and does not verify that the requested post is published or that the requester has read access.

Because WordPress assigns post IDs sequentially, an attacker can script requests across a numeric range to enumerate every symbol post on the site. Draft, private, and trashed symbols are returned in the same response format as published entries. Confidentiality impact is scoped to information disclosure with no integrity or availability effects.

Root Cause

The root cause is missing authorization on the symbol retrieval AJAX endpoint. The handler relies on the WordPress AJAX framework being reachable without validating current_user_can() or post_status before serializing the record. Referenced vulnerable source lines include line 73 of includes/Ajax.php and lines 145 and 245 of includes/Ajax/Symbol.php.

Attack Vector

Exploitation requires only network access to wp-admin/admin-ajax.php on the target site. An attacker sends the AJAX action registered by Kirki with an id parameter set to a candidate integer. The server responds with the JSON payload representing the symbol, including its builder tree and rendered HTML. Iterating IDs from 1 upward yields comprehensive enumeration without authentication, session tokens, or user interaction.

No public proof-of-concept exploit and no confirmed in-the-wild exploitation have been recorded at publication time.

Detection Methods for CVE-2026-12122

Indicators of Compromise

Repeated unauthenticated POST requests to wp-admin/admin-ajax.php referencing the Kirki symbol action with incrementing id parameters.
Large volumes of successful 200 OK AJAX responses to a single client IP within a short interval.
Access log entries lacking a valid wp-* authentication cookie but retrieving symbol JSON payloads.

Detection Strategies

Deploy web application firewall rules that rate-limit or block unauthenticated calls to Kirki symbol AJAX actions.
Correlate anomalous admin-ajax.php request patterns with source IP reputation and User-Agent strings to flag automated enumeration.
Review WordPress access logs for sequential id parameter values indicative of ID iteration.

Monitoring Recommendations

Alert on outbound bandwidth spikes from web servers hosting the Kirki plugin, which may indicate bulk content extraction.
Monitor for new or updated kirki_symbol posts and reconcile against expected editorial activity.
Track plugin version drift across the WordPress fleet to identify hosts still running 6.0.11 or earlier.

How to Mitigate CVE-2026-12122

Immediate Actions Required

Update the Kirki plugin to a patched release above 6.0.11 as published in the WordPress plugin repository changeset 3584702.
Audit all kirki_symbol posts for sensitive content that may have been exposed while the vulnerable version was active.
Restrict access to wp-admin/admin-ajax.php at the WAF or reverse proxy layer for unauthenticated actions where feasible.

Patch Information

The vendor addressed the flaw by adding authorization checks to the symbol AJAX handler. Refer to the WordPress Kirki Change Set and the Wordfence Vulnerability Report for remediation details. Vulnerable source paths include the WordPress Kirki Ajax File and the WordPress Kirki Symbol File.

Workarounds

Deactivate the Kirki plugin until an update can be applied if patching is not immediately possible.
Add a WAF rule blocking unauthenticated requests whose payload targets the Kirki symbol AJAX action.
Temporarily remove or unpublish sensitive kirki_symbol draft posts from affected sites.

bash

# Example WAF rule (ModSecurity) to block unauthenticated Kirki symbol AJAX calls
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012226,msg:'Block CVE-2026-12122 Kirki symbol enumeration'"
  SecRule ARGS:action "@rx ^kirki.*symbol" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"