CVE-2026-13464: Kirki WordPress Plugin IDOR Vulnerability

CVE-2026-13464 Overview

CVE-2026-13464 is an Insecure Direct Object Reference (IDOR) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all versions up to and including 6.0.14. The plugin fails to validate a user-controlled key in the context parameter of its frontend REST API. Unauthenticated attackers can read the full title, content, and excerpt of any WordPress post by supplying an arbitrary post ID. This exposure includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts, regardless of author. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can read the contents of any WordPress post, including private, draft, password-protected, and trashed posts.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All versions up to and including 6.0.14
WordPress sites exposing the plugin's frontend REST API endpoints

Discovery Timeline

2026-07-24 - CVE-2026-13464 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-13464

Vulnerability Analysis

The vulnerability resides in the plugin's frontend REST API controllers, specifically CollectionController.php and FrontendRESTController.php. These controllers accept a context parameter from the request and use it as a key to retrieve post data. The controllers do not verify that the requesting user has permission to view the referenced post, nor do they confirm that the post status is public. Because the parameter is directly used to look up post data, an attacker can supply any numeric post ID and receive back the full title, content, and excerpt. The endpoint requires no authentication, so the attack can be launched from any network location.

Root Cause

The root cause is missing authorization validation on a user-controlled key. The plugin trusts the context parameter without cross-checking WordPress post visibility rules such as read_private_posts, edit_posts, or password protection. WordPress normally enforces these controls through core capability checks, which the Kirki API bypasses.

Attack Vector

An unauthenticated attacker sends an HTTP request to the plugin's frontend REST route while supplying an arbitrary post ID via the context parameter and an attacker-controlled block template. The API responds with the raw post title, content, and excerpt, disregarding the post's post_status field (draft, pending, private, trash) and any password protection. Attackers can enumerate post IDs sequentially to harvest all non-public content on the site. No user interaction or elevated privileges are required.

Refer to the Wordfence Vulnerability Report and the Kirki source code at CollectionController.php Line 117 for the vulnerable request handling logic.

Detection Methods for CVE-2026-13464

Indicators of Compromise

Unauthenticated HTTP requests to Kirki frontend REST routes containing a context parameter with numeric post IDs
Sequential post ID enumeration patterns in web server access logs targeting the plugin's API endpoints
Requests referencing unpublished, private, or trashed post IDs that would not exist in normal site navigation
Anomalous outbound access to /wp-json/ routes registered by the kirki namespace

Detection Strategies

Inspect WordPress and web server access logs for repeated calls to Kirki REST endpoints from the same client IP within short time windows
Correlate REST API request volume against post ID ranges to identify enumeration behavior
Alert on unauthenticated access to plugin REST routes that return post content fields such as title, content, or excerpt

Monitoring Recommendations

Enable WordPress REST API request logging and forward logs to a central SIEM for retention and analysis
Monitor for unusual response sizes from Kirki REST endpoints that may indicate bulk content extraction
Track user-agent strings and source IPs interacting with /wp-json/kirki/ routes to identify automated scrapers

How to Mitigate CVE-2026-13464

Immediate Actions Required

Update the Kirki plugin to a patched version released after 6.0.14 as soon as it becomes available from the vendor
Restrict access to the plugin's REST API endpoints at the web server or WAF layer until patching is complete
Audit WordPress access logs for prior exploitation attempts targeting Kirki REST routes

Patch Information

The vendor addressed the flaw in a patch tracked by the WordPress Kirki Changeset. Site administrators should upgrade to the fixed release once available in the WordPress plugin repository. Review the Wordfence Vulnerability Report for confirmed fixed versions.

Workarounds

Disable the Kirki plugin until an updated version can be installed
Use a Web Application Firewall (WAF) rule to block unauthenticated requests to Kirki REST routes containing a context parameter
Restrict access to /wp-json/ endpoints by IP allowlist where feasible
Rotate any sensitive information that may have resided in draft or private posts on affected sites

bash

# Example WAF rule to block unauthenticated Kirki REST requests
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@rx /wp-json/kirki/.*" \
  "id:1013464,phase:1,deny,status:403,\
   msg:'Block unauthenticated Kirki REST access (CVE-2026-13464)'"