CVE-2026-77754: Unknown Kirki

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.

Affected products

• Unknown Kirki: before 6.0.14 (fixed in 6.0.14)

Published 2026-08-26. Last modified 2026-08-26.