What is the CVSS score of CVE-2026-12122?

CVE-2026-12122 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Kirki Page Builder CVE-2026-12122

EUVD-2026-41264 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Wordfence

GHSA-v9qp-6jjw-6rfv

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Kirki Freeform Page Builder Website Builder Customizer Themeum

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

AJAX endpoint is unauthenticated and network-reachable by default; confidentiality impact is low as exposure is scoped to kirki_symbol post content only, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:19 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by supplying a sequential WordPress post ID.

AnalysisAI

Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. No active exploitation is confirmed in CISA KEV, and no EPSS data was provided, but the trivially automatable nature of post ID enumeration against an unauthenticated network endpoint elevates practical risk above the raw CVSS 5.3 score suggests.

Technical ContextAI

The vulnerability resides in the Kirki plugin's AJAX subsystem, specifically the get_single_symbol action handler defined in includes/Ajax/Symbol.php (lines 145 and 245, as seen in plugin tags 6.0.5 and 6.0.9) and registered in includes/Ajax.php (line 73). WordPress AJAX endpoints registered via wp_ajax_nopriv_ (or equivalent no-auth hooks) are accessible to unauthenticated users. CWE-862 (Missing Authorization) confirms that the handler performs no capability or ownership check before returning post content. The affected CPE is cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:* (vendor: Themeum). Because WordPress auto-increments post IDs sequentially, an attacker can systematically enumerate all kirki_symbol posts without any prior knowledge of the site's content structure.

RemediationAI

A fix has been committed to the WordPress plugin repository as changeset 3584702 (https://plugins.trac.wordpress.org/changeset?old=3584702%40kirki&new=3584702%40kirki); however, the exact patched release version number is not independently confirmed from the available data - update to the latest available version in the WordPress plugin directory and verify it is newer than 6.0.11. As a compensating control if immediate upgrade is not possible, consider blocking unauthenticated access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) at the web server or WAF layer for requests specifying the get_single_symbol action - note this will disable the front-end symbol-loading functionality for anonymous visitors. Alternatively, if no site visitors require access to kirki_symbol post rendering while unauthenticated, restricting the endpoint via a firewall rule to authenticated sessions only eliminates the exposure with minimal functional impact.