WordPress Plugin Vulnerabilities

Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

Description

The plugin does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.

Proof of Concept

Affects Plugins

Plugin icon
kirki
Fixed in 6.3.0

References

CVE
CVE-2026-84225

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.2 (low)

Miscellaneous

Original Researcher
Revanth Meesala
Submitter
Revanth Meesala
Verified
Yes
WPVDB ID
9f83f0a2-7d77-49a2-a23a-03f787e2e356

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2026-08-26
Title
User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR
Published
2025-10-17
Title
WPC Smart Quick View for WooCommerce < 4.2.6 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
Published
2024-12-03
Title
LA-Studio Element Kit for Elementor < 1.4.5 - Authenticated (Contributor+) Post Disclosure
Published
2025-03-14
Title
School Management System – WPSchoolPress < 2.2.17 - Teacher+ Privilege Escalation
Published
2026-01-02
Title
Dolcino <= 1.6 - Authenticated (subscriber+) Insecure Direct Object Reference