Description

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:29.510Z",
  "pubdate": "2026-08-26T06:16:29.510Z",
  "executiveSummary": "The Kirki WordPress plugin, in versions prior to 6.0.14, contains a critical Broken Access Control vulnerability. This security flaw stems from the failure to implement appropriate capability checks on specific public AJAX endpoints. Consequently, unauthenticated remote attackers can bypass authorization mechanisms to retrieve sensitive information.\nThe impact of this vulnerability is significant, as it allows for the unauthorized extraction of PII (Personally Identifiable Information), including email addresses of registered users and comment authors. Furthermore, the vulnerability enables the retrieval of non-public page content and internal application settings. This exposure risks user privacy, potentially facilitates targeted phishing or social engineering campaigns, and compromises the integrity of site configuration data. The vulnerability is exploitable over the network without requiring any prior authentication or special privileges, making it a high-risk security deficiency for any WordPress installation utilizing the affected versions of the Kirki plugin.",
  "technicalDetails": "The vulnerability resides within the AJAX action handler framework implemented by the Kirki plugin. Specifically, the plugin exposes multiple endpoints designed to facilitate administrative or configuration tasks, but fails to validate the current user's session or associated capabilities (e.g., 'manage_options') before processing the request. This missing authorization check allows the plugin to fulfill requests initiated by unauthenticated actors.\nThe root cause is an insecure implementation of the WordPress AJAX API hooks (wp_ajax_nopriv_). By utilizing the nopriv variant of these hooks, the plugin explicitly permits execution by unauthorized users. The internal logic fails to perform secondary validation, such as checking 'current_user_can()' permissions, within the callback functions associated with these endpoints. This architectural oversight allows an attacker to manipulate the AJAX request parameters to query data sources that should be restricted to authenticated administrative accounts.\nThe attack flow proceeds as follows: 1) An attacker identifies the exposed AJAX endpoint within the Kirki plugin. 2) The attacker crafts an HTTP POST request targeting 'wp-admin/admin-ajax.php' with the 'action' parameter set to the vulnerable Kirki function. 3) Because the function lacks internal capability checks, it executes the underlying data retrieval logic. 4) The plugin queries the WordPress database for user metadata, email addresses, or page content as defined by the provided action parameters. 5) The server returns the requested data in the JSON response, effectively leaking sensitive information to the unauthenticated attacker.\nExploitation does not require elevated privileges or interaction with an administrative user, as the vulnerability is inherent to the server-side processing of the AJAX request. The exposure extends to the database layer, specifically targeting user tables and post objects. Post-exploitation, an attacker can harvest a complete list of user email addresses, which may be leveraged for credential stuffing, spam campaigns, or further reconnaissance to identify administrative accounts for secondary attacks. Additionally, accessing non-public page content and settings may lead to the exposure of proprietary business logic, site structure, or sensitive configuration keys, significantly lowering the barrier for full site compromise."
}