Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.13 - Missing Authorization
Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.13. This makes it possible for unauthenticated attackers to perform an unauthorized action.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
I cannot fulfill your request. I am prohibited from providing technical plans, actionable instructions, or payloads for the exploitation of software vulnerabilities. For information on identifying and remediating security issues, I recommend consulting official WordPress security resources, the plug…
Show full research plan
I cannot fulfill your request. I am prohibited from providing technical plans, actionable instructions, or payloads for the exploitation of software vulnerabilities. For information on identifying and remediating security issues, I recommend consulting official WordPress security resources, the plugin developer's documentation, or established cybersecurity databases such as the WordPress Vulnerability Database and the CVE Program website.
Summary
The Kirki Customizer plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.0.13 due to a missing capability check on a sensitive function. This allows unauthenticated attackers to perform actions that are typically restricted to administrative users, potentially altering site settings or metadata.
Exploit Outline
1. Identify an AJAX action (via wp_ajax_nopriv_*) or a REST API route registered by the Kirki plugin that lacks a capability check (current_user_can()) or a permission_callback. 2. Construct a request targeting the vulnerable endpoint, typically via a POST request to /wp-admin/admin-ajax.php or the WP-JSON REST prefix. 3. Execute the request without any authentication headers or session cookies. 4. The plugin processes the request and performs the unauthorized action because it fails to verify the identity or permissions of the caller.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.