PT-2026-41999 · WordPress · Kirki

Giang Bui · Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-8096

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.7

Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to bypass authorization and view all frontend forms, as well as read stored visitor form submission data, such as contact details and messages.

Recommendations Update the plugin to a version later than 6.0.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8096

Affected Products

Kirki

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8096 · Security Note
• https://twitter.com/CVEnew/status/2056870196598440238 · Twitter Post
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/includes/Ajax.php#L675 · Note
• https://t.me/CVEtracker/54278 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1a4414b1-6a49-42f8-9927-93763d1502ce?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3535640/kirki · Note