Kirki Page Builder CVE-2026-12122

The Kirki plugin (version ≤ 6.0.11) must be installed and active on the WordPress site. The target site must have at least one post of the kirki_symbol custom post type (created through the Kirki builder workflow). No authentication, no special configuration, and no user interaction are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is exploitable against default plugin installations over the network. Exploitation is limited to kirki_symbol post type content only; general WordPress posts, pages, or other post types are not exposed through this endpoint. The practical impact is further bounded by whether the site stores sensitive pre-publication content in kirki_symbol posts.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium). The attack vector is network, complexity is low, no privileges or user interaction are required, and scope is unchanged with only low confidentiality impact - meaning the exposure is bounded to kirki_symbol post content rather than broader site secrets. No EPSS score was provided in the available data, limiting probabilistic exploitation comparison. The vulnerability is not listed in CISA KEV, and no public POC has been identified at time of analysis. However, the automatable nature of post ID enumeration (no brute-forcing, just sequential integers) means the effective attack complexity is extremely low in practice, and the CVSS AC:L rating accurately reflects this. The primary real-world concern is exposure of pre-publication draft content - business logic, unreleased marketing copy, or staged page designs - which may carry confidentiality value disproportionate to the 'Low' CVSS C metric. Sites not using the kirki_symbol post type for sensitive staged content face materially lower risk.

An attacker issues a series of HTTP POST requests to the target WordPress site's wp-admin/admin-ajax.php endpoint, specifying action=get_single_symbol and incrementing the post ID parameter from 1 upward. Because no authorization check is performed, the server returns the full builder metadata and rendered HTML for each matching kirki_symbol post, including any that are in draft or pending status and not yet publicly visible. This enumeration can be fully automated with a simple script requiring no credentials or prior site knowledge.