Kirki CVE-2026-84225

Exploitation requires all of the following: (1) The target WordPress installation must have the Kirki plugin version 6.0.0-6.2.x installed with the page builder and collaboration comment feature active - this is not a default WordPress feature; (2) An administrator must have explicitly granted the attacker content-level page builder access - this is a deliberate, non-default role assignment made by a site admin; (3) The attacker must hold valid WordPress credentials for that content-level account. Impact is strictly limited to altering comment state metadata on collaboration comments - no content reading of inaccessible pages, no code execution, no privilege escalation to admin, and no data exfiltration are possible. The high privilege prerequisite and single-site-scoped impact make this an insider/trusted-user threat rather than an external attack.

Real-world risk is low to negligible. The provided CVSS 3.1 base score of 2.2 is internally consistent with the narrow impact: AC:H reflects the prerequisite that an administrator must have explicitly granted the attacker content-level access, PR:H reflects that the attacker holds a privileged (though sub-admin) role, and I:L with C:N/A:N correctly captures that only comment state integrity is at stake - no data exposure and no service disruption are possible. EPSS at 0.13% (3rd percentile) confirms very low exploitation probability. The vulnerability is absent from the CISA KEV catalog. Although WPScan documents a publicly available PoC, the exploitation prerequisites - a specific admin-configured content role plus valid WordPress credentials - substantially limit the realistic attack surface. This is an internal trust-boundary issue relevant to multi-editor workflows, not an externally facing attack. One metric disagreement worth noting: the provided CVSS assigns PR:H, but the description characterizes the attacker as a user whom an administrator has granted content-level access - sub-admin, suggesting PR:L may be more accurate. This does not materially change the risk posture but is worth flagging for NVD reconciliation.

A content editor with administrator-granted page builder access intercepts or enumerates collaboration comment IDs (visible in API calls during normal page builder use), then crafts a direct request to the comment-state endpoint referencing a comment on a page they cannot open. The server processes the state change without authorization checks, allowing the attacker to mark other users' review comments as resolved or dismissed, disrupting a design approval workflow. A publicly available PoC from WPScan demonstrates this technique.