The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modi…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.1%

3. Sep 8, 2026Record revised

   Last analysed / modified upstream

4. Sep 8, 2026CVSS changed

   2.2 → —

5. Sep 8, 2026Severity changed

   low → none

6. Sep 9, 2026CVSS changed

   — → 2.2

7. Sep 9, 2026Severity changed

   none → low

8. Sep 9, 2026CVSS changed

   2.2 → —

9. Sep 9, 2026Severity changed

   low → none

10. Sep 9, 2026CVSS changed

    — → 2.2

11. Sep 9, 2026Severity changed

    none → low

12. Sep 9, 2026CVSS changed

    2.2 → —

13. Sep 9, 2026Severity changed

    low → none

14. Sep 9, 2026CVSS changed

    — → 2.2

15. Sep 9, 2026Severity changed

    none → low

16. Sep 25, 2026EPSS peak

    0.1% → 0.2%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 2.2
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 2.2 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 2.2
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 2.2 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 2.2
• Sep 9, 2026Severity none → low
• Sep 8, 2026CVSS 2.2 → —
• Sep 8, 2026Severity low → none