CVE-2026-12122: Kirki Plugin Sensitive Information Disclosure Vulnerability (WordPress)

Technical summary

CVE-2026-12122 is a sensitive information disclosure vulnerability in the Kirki plugin affecting versions 6.0.11 and earlier. The vulnerability exists in the get_single_symbol function, which fails to implement proper access controls. An unauthenticated attacker can request builder metadata and rendered HTML for any kirki_symbol post type by supplying a sequential WordPress post ID. This allows extraction of unpublished drafts and their complete builder configuration, which would normally require administrative privileges to view.

Business impact

Website owners using Kirki risk exposure of draft page designs, unreleased marketing content, and internal site structure before publication. In some cases, exposed drafts may contain sensitive business logic, API references, or configuration details embedded in builder metadata. The ease of exploitation—requiring only sequential ID enumeration—makes this a concern for any organization using this plugin in a shared hosting environment or with competitive sensitivity around unreleased content.

Affected systems

WordPress installations using the Kirki – Freeform Page Builder, Website Builder & Customizer plugin in version 6.0.11 or earlier are affected. The vulnerability impacts all instances, regardless of site configuration, because it requires no authentication and targets a core function of the plugin.

Exploitability

This vulnerability is highly exploitable. An attacker needs only network access and knowledge of sequential WordPress post IDs—information readily available through basic WordPress enumeration. No authentication is required, no special tools are needed, and the attack is trivial to automate. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects the low attack complexity and lack of privilege or user interaction requirements.

Remediation

Update the Kirki plugin to the latest available version beyond 6.0.11, which should include proper access control checks in the get_single_symbol function. Verify the patch in the official plugin repository or vendor advisory before deploying. As a temporary mitigation, restrict access to the WordPress REST API endpoints or admin-ajax.php at the web server level for users who cannot update immediately, though this is not a complete fix.

Patch guidance

Check the official Kirki plugin page on WordPress.org or the vendor's security advisories for the patched version number and release date. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or via command line if managing WordPress programmatically. Test on a staging environment first to ensure compatibility with your theme and other plugins. Monitor the plugin changelog to confirm the fix addresses access control in the get_single_symbol endpoint.

Detection guidance

Review web server and WordPress access logs for requests to get_single_symbol or similar endpoints with sequential post ID parameters, especially from unauthenticated sessions. Monitor for unusual patterns of REST API calls targeting post endpoints. Consider enabling WordPress security plugins that log admin-ajax.php activity. If feasible, audit recent post metadata exports to identify whether drafts or sensitive builder configurations were accessed outside normal administrative activity.

Why prioritize this

Although the CVSS score of 5.3 is moderate, the trivial exploitability, widespread use of page builders in WordPress, and ease of automation warrant timely patching. The exposure of unpublished content and internal site structure could facilitate further reconnaissance for more damaging attacks. Organizations should prioritize this in their patch schedule, especially if they maintain draft content with business sensitivity.

Risk score, explained

The CVSS 5.3 (MEDIUM) score reflects confidentiality impact from unauthenticated disclosure, balanced against the absence of integrity or availability impact. The score does not fully capture exploitability ease or the breadth of affected sites, making practical risk higher than the numeric score alone suggests. Organizations should apply their own risk multiplier based on whether they store sensitive information in unpublished pages.

Frequently asked questions