---
id: CVE-2026-112347
title: Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
summary: >-
  Kirki plugin for WordPress before 6.4.1 contains a broken object-level access
  control vulnerability in its page REST API, where the PUT
  /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and
  delete handlers in Pag…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: Themeum
product: Kirki
affected:
  - Kirki < 6.4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T14:03:50.737679Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T14:04:03.894Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112347'
references:
  - url: 'https://wordpress.org/plugins/kirki/#developers'
    label: WordPress Plugin Changelog
  - url: >-
      https://www.vulncheck.com/advisories/kirki-wordpress-plugin-broken-object-level-access-control-via-page-api
    label: >-
      VulnCheck Advisory: Kirki WordPress Plugin < 6.4.1 Broken Object-Level
      Access Control via Page API
tags:
  - cve.org
epss: 0.00282
epssPercentile: 0.20875
ingestedAt: '2026-11-05T16:07:30.274Z'
---

## Overview

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.

## Affected

- `Kirki < 6.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.