What is the CVSS score of CVE-2026-13464?

CVE-2026-13464 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Kirki Plugin CVE-2026-13464

EUVD-2026-48463 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-24 Wordfence

GHSA-xr23-vhrq-p5fv

WordPress Authentication Bypass Wordpress Plugin Kirki Freeform Page Builder Website Builder Customizer Themeum

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network REST API access, no complexity barriers, read-only content disclosure with no integrity or availability impact justifies C:L/I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:03 vuln.today

CVE Published

Jul 24, 2026 - 02:31 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post - including drafts, pending, privately published, password-protected, and trashed posts - regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.

AnalysisAI

Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated context parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.

Technical ContextAI

The vulnerability resides in two REST API controllers within the Kirki plugin's frontend API layer: CollectionController.php (lines 33 and 117) and FrontendRESTController.php (line 39), as referenced in the WordPress plugin trac for versions 6.0.1 and 6.0.12. The plugin accepts an attacker-supplied post ID via the context parameter and an attacker-controlled block template, then retrieves and returns the post without validating whether the requesting user is authorized to view that post's visibility state. This is a textbook CWE-639 (Authorization Through User-Controlled Key) flaw: the authorization decision is delegated to a user-controlled identifier with no server-side enforcement of WordPress's native post-visibility model (draft, private, password, trash). The CPE cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:* confirms the affected vendor is Themeum.

RemediationAI

An upstream code fix has been committed to the WordPress plugin repository (changeset 3617070 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3617070%40kirki&new=3617070%40kirki); however, the exact released patched version number is not independently confirmed from the available data - site administrators should update the Kirki plugin to the latest available version via the WordPress dashboard and verify the installed version exceeds 6.0.14. As an interim compensating control, administrators can restrict unauthenticated access to WordPress REST API endpoints (e.g., by returning a 401 for unauthenticated requests to wp-json using a security plugin such as Wordfence or Disable REST API), though this may break legitimate frontend functionality of the Kirki page builder that depends on unauthenticated REST calls - test thoroughly before applying. Review Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/84f65255-f710-44f9-9f77-61776a40abae for the confirmed patched version once released.