MEDIUM 5.3 NVD

CVE-2026-84222

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowin

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.

References

https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf/

Published: 2026-09-09 · Source: NVD · Feed updated: 2026-09-11

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-09 via NVD.

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.