What is the CVSS score of CVE-2026-12122?

CVE-2026-12122 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Kirki Page Builder CVE-2026-12122

EUVD-2026-41264 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Wordfence

GHSA-v9qp-6jjw-6rfv

Authentication Bypass WordPress Information Disclosure Kirki Freeform Page Builder Website Builder Customizer

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

AJAX endpoint is unauthenticated and network-reachable by default; confidentiality impact is low as exposure is scoped to kirki_symbol post content only, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:19 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by supplying a sequential WordPress post ID.

AnalysisAI

Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Kirki ≤ 6.0.11

Delivery

Send unauthenticated POST to admin-ajax.php with action=get_single_symbol

Exploit

Supply sequential integer post IDs

Execution

Receive builder metadata and rendered HTML for each kirki_symbol post

Impact

Extract unpublished draft content

Access

Identify WordPress site running Kirki ≤ 6.0.11

Delivery

Send unauthenticated POST to admin-ajax.php with action=get_single_symbol

Exploit

Supply sequential integer post IDs

Execution

Receive builder metadata and rendered HTML for each kirki_symbol post

Impact

Extract unpublished draft content

Vulnerability AssessmentAI

Exploitation	The Kirki plugin (version ≤ 6.0.11) must be installed and active on the WordPress site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker issues a series of HTTP POST requests to the target WordPress site's wp-admin/admin-ajax.php endpoint, specifying action=get_single_symbol and incrementing the post ID parameter from 1 upward. Because no authorization check is performed, the server returns the full builder metadata and rendered HTML for each matching kirki_symbol post, including any that are in draft or pending status and not yet publicly visible. …
Remediation	A fix has been committed to the WordPress plugin repository as changeset 3584702 (https://plugins.trac.wordpress.org/changeset?old=3584702%40kirki&new=3584702%40kirki); however, the exact patched release version number is not independently confirmed from the available data - update to the latest available version in the WordPress plugin directory and verify it is newer than 6.0.11. … Detailed patch versions, workarounds, and compensating controls in full report.