CVE-2026-84222 Overview
The Kirki WordPress plugin before version 6.3.0 contains a broken access control vulnerability that exposes non-public post content to unauthenticated users. The plugin renders and returns page content without verifying whether the requester has read permission on the target post. Attackers can retrieve content from private, draft, pending, and trashed posts that should only be visible to authorized users. The flaw is categorized as an information exposure issue tracked under [CWE-200].
Critical Impact
Unauthenticated remote attackers can read the content of private, draft, pending, and trashed WordPress pages, exposing unpublished editorial content, internal documentation, or sensitive drafts.
Affected Products
- Kirki WordPress plugin versions prior to 6.3.0
- WordPress sites using Kirki for theme customization
- Any WordPress deployment shipping the vulnerable Kirki bundled with a theme
Discovery Timeline
- 2026-09-09 - CVE-2026-84222 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-84222
Vulnerability Analysis
The vulnerability resides in Kirki's page rendering logic, which returns post content to any HTTP requester without evaluating the caller's authentication state or read capability. WordPress enforces post visibility through capability checks such as read_private_posts and status filtering in WP_Query. Kirki's affected endpoint bypasses these controls. The result is an unauthenticated information disclosure that affects every post status normally restricted from public view.
Attackers exploit this by issuing standard HTTP requests to the vulnerable endpoint and referencing post identifiers. No credentials, user interaction, or elevated privileges are required. The impact is limited to confidentiality; the flaw does not permit modification or denial of service.
Root Cause
The root cause is missing authorization enforcement in Kirki's request handler. The plugin invokes rendering logic that fetches post content by ID and returns it in the response, but omits calls to current_user_can() or equivalent capability checks against the target post. Post status filtering that would normally exclude private, draft, pending, and trash states is not applied before the content is emitted.
Attack Vector
Exploitation occurs over the network against the WordPress front end. An attacker enumerates or guesses post IDs and requests the vulnerable Kirki endpoint. The server responds with the rendered content of the target post regardless of its status. See the WPScan Vulnerability Report for endpoint specifics and reproduction details.
No public proof-of-concept exploit code has been released. The EPSS model currently places this issue in the low-likelihood band for near-term exploitation.
Detection Methods for CVE-2026-84222
Indicators of Compromise
- Unauthenticated HTTP requests to Kirki plugin endpoints referencing sequential or enumerated post IDs
- Access log entries showing requests to Kirki handlers from IP addresses that never authenticate to wp-login.php
- Response payloads containing content from posts whose status in the database is private, draft, pending, or trash
Detection Strategies
- Compare rendered response content against the wp_posts table to identify responses that leaked non-publish status content
- Correlate WordPress access logs with the installed Kirki version to flag hosts running versions prior to 6.3.0
- Deploy web application firewall rules that alert on anonymous requests to Kirki-controlled routes
Monitoring Recommendations
- Enable verbose WordPress request logging and forward logs to a central analytics platform for anomaly review
- Alert on unusual volumes of anonymous requests targeting a small set of post IDs, which suggests enumeration
- Track outbound response sizes from Kirki endpoints to detect bulk content extraction
How to Mitigate CVE-2026-84222
Immediate Actions Required
- Update the Kirki plugin to version 6.3.0 or later on every affected WordPress instance
- Audit wp_posts for private, draft, and pending content that may have been exposed prior to patching
- Rotate or revoke any secrets, API keys, or internal URLs that were stored inside unpublished posts
Patch Information
The vendor addressed the issue in Kirki 6.3.0 by adding capability and post-status checks before returning post content. Administrators should upgrade through the WordPress plugin manager or WP-CLI using wp plugin update kirki. Full remediation details are available in the WPScan Vulnerability Report.
Workarounds
- Disable or remove the Kirki plugin until the upgrade to 6.3.0 can be completed
- Restrict access to Kirki request handlers at the web server or WAF layer, permitting only authenticated administrative sessions
- Move highly sensitive draft content out of WordPress until the patch is applied
# Configuration example
wp plugin update kirki --version=6.3.0
wp plugin get kirki --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
