What is the CVSS score of CVE-2026-8096?

CVE-2026-8096 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Kirki WordPress Plugin CVE-2026-8096

EUVD-2026-30971 MEDIUM

Missing Authorization (CWE-862)

2026-05-19 Wordfence

GHSA-5238-w669-cg23

WordPress Authentication Bypass Wordpress Plugin Kirki Freeform Page Builder Website Builder Customizer Themeum

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 19:32 vuln.today

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.

AnalysisAI

Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.6) allows authenticated attackers with subscriber-level privileges to enumerate and read all frontend form structures and stored visitor submission data, including contact details and messages submitted through any site form powered by the plugin. The flaw originates in missing authorization checks on an AJAX handler (Ajax.php, line 675), meaning any logged-in user - including the lowest-privilege role WordPress assigns - can exfiltrate sensitive visitor-submitted information without any administrative context. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege barrier and network-accessible attack vector make this a realistic data exposure risk for any multi-user or public-registration WordPress site running the affected plugin.

Technical ContextAI

The affected product is the Kirki plugin (CPE: cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*) developed by Themeum for the WordPress ecosystem. The root cause is CWE-862 (Missing Authorization): the plugin registers an AJAX action handler in includes/Ajax.php at approximately line 675 without a capability check or nonce-gated authorization verification before returning form configuration and submission data. WordPress AJAX endpoints are accessible to any authenticated session by default when registered via wp_ajax_ hooks without supplemental permission enforcement. Because WordPress subscribers hold only the 'read' capability, the absence of any elevated capability check (e.g., manage_options or a custom capability) means the endpoint is reachable by the broadest possible authenticated audience. The CVSS vector (AV:N/AC:L/PR:L/UI:N) corroborates this: network-reachable, low complexity, low privilege, no user interaction required.

RemediationAI

The primary fix is to update the Kirki plugin to the version incorporating changeset 3535640 (https://plugins.trac.wordpress.org/changeset/3535640/kirki), which addresses the missing authorization check in Ajax.php. The exact released version number of the patched build has not been independently confirmed from the available data - administrators should verify the installed version against the WordPress plugin repository changelog and ensure they are running a version newer than 6.0.6. If an immediate update is not feasible, a compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which removes the ability for external parties to obtain the subscriber-level session required for exploitation - note this impacts legitimate registration workflows. Alternatively, a WAF rule blocking unauthenticated or low-privilege access to the specific wp-admin/admin-ajax.php action registered by the Kirki AJAX handler can mitigate exploitation while the patch is staged, though this requires identifying the specific action name from the plugin source. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4414b1-6a49-42f8-9927-93763d1502ce should be monitored for patched version confirmation.