PT-2026-54939 · Themeum · Kirki – Freeform Page Builder

Jagadesh Achanta · Publicado 2026-07-02 · Atualizado 2026-07-02 · CVE-2026-12122

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get single symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-12122

Produtos afetados

Kirki – Freeform Page Builder

Referências · 9

• https://wordfence.com/threat-intel/vulnerabilities/id/8b5db7fa-2e72-4719-b85e-cc31778c2274?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.5/includes/Ajax/Symbol.php#L245 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-12122 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/Ajax.php#L73 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3584702%40kirki&new=3584702%40kirki&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.5/includes/Ajax/Symbol.php#L145 · Nota
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/Ajax/Symbol.php#L145 · Nota
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/Ajax/Symbol.php#L245 · Nota
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.5/includes/Ajax.php#L73 · Nota