Kirki – Freeform Page Builder, Website Builder & Customizer

Information

Software Type	Plugin
Software Slug	kirki (view on wordpress.org)
Software Status	Active
Software Author	themeum
Software Website	kirki.com
Software Downloads	14,158,044
Software Active Installs	500,000
Software Record Last Updated	July 11, 2026

6 Vulnerabilities

Submit a Vulnerability

Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action

5.3

CVE-2026-12122

Jul 1, 2026

Researcher: Jagadesh Achanta

Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters

5.3

CVE-2026-12472

Jul 1, 2026

Researchers: Niv Kochan, Matan Bahar

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVE-2026-57627

Jun 26, 2026

Researcher: Ananda Dhakal

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

9.8

CVE-2026-8206

Jun 1, 2026

Researcher: CHOIGYEONGMIN

Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

7.5

CVE-2026-8073

May 19, 2026

Researcher: Rafie Muhammad

Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action

6.5

CVE-2026-8096

May 19, 2026

Researcher: Z3no

Title	Status	CVE ID	CVSS	Researchers	Date
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action	Patched	CVE-2026-12122	5.3	Jagadesh Achanta	July 1, 2026
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters	Patched	CVE-2026-12472	5.3	Niv Kochan, Matan Bahar	July 1, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery	Patched	CVE-2026-57627	6.4	Ananda Dhakal	June 26, 2026
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'	Patched	CVE-2026-8206	9.8	CHOIGYEONGMIN	June 1, 2026
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP	Patched	CVE-2026-8073	7.5	Rafie Muhammad	May 19, 2026
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action	Patched	CVE-2026-8096	6.5	Z3no	May 19, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation