Kirki vulnerabilities

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.

The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.

The Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability. Unauthenticated attackers can submit frontend forms without valid verification by omitting the g-recaptcha-token field in POST requests, because the verify() method returns early on empty token values.

The Kirki WordPress plugin in versions up to 6.4.0 contains an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability that allows code injection. The issue affects versions from n/a through 6.4.0.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress in versions up to and including 6.3.2 is vulnerable to Insecure Direct Object Reference via the 'context' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to expose arbitrary users' sensitive profile data, including email address, display name, registration date, profile image URL, and user meta fields.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress in versions up to and including 6.3.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. This allows authenticated attackers with administrator-level access and above to inject a PHP Object; by default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This is due to the plugin substituting a user's display_name into the composed page markup unfiltered and then running the whole result through do_shortcode().

Improper validation of specified quantity in input in Kirki up to version 6.3.1. Allows accessing functionality not properly constrained by ACLs.

The Kirki WordPress plugin before version 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.

The Kirki WordPress plugin before version 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.

The Kirki WordPress plugin before version 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.

The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.

Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress up to version 6.1.1 is vulnerable to authorization bypass, allowing authenticated attackers with custom-level access to read arbitrary user metadata and sensitive user record fields, including email address, roles, registration date, and user_meta values, belonging to any user including administrators.

The Kirki plugin for WordPress up to version 6.1.1 is vulnerable to Directory Traversal via the 'data' parameter. Authenticated attackers with editor-level access and above can read arbitrary files on the server, including sensitive information, by bypassing the strpos()-based guard with traversal sequences in the URL.

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

The Kirki plugin for WordPress (up to version 6.2.0) is vulnerable to Stored Cross-Site Scripting via the post_meta shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts.

The Kirki plugin for WordPress is vulnerable to Path Traversal (Zip Slip) via the extract_zip_file function. Attackers with custom-level access can write arbitrary files on the server, potentially leading to remote code execution.

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection triggered when an administrator later reviews the stored data. With a suitable gadget chain, this could lead to remote code execution.

The Kirki plugin version 6.0.13 and earlier has an arbitrary file deletion vulnerability for users with the Editor role. An Editor can delete any file on the server.

The Kirki plugin for WordPress up to version 6.0.14 contains an Insecure Direct Object Reference vulnerability via the 'context' parameter, allowing unauthenticated attackers to read the title, content, and excerpt of any WordPress post, including drafts, pending, private, password-protected, and trashed posts.

The Kirki WordPress plugin before version 6.0.12 does not sanitize or escape the email subject and body values supplied in a request before including them in the password-reset email sent as HTML. This allows unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

The Kirki WordPress plugin before version 6.0.12 does not perform any authorization check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

The Kirki plugin for WordPress is vulnerable to Directory Traversal via the 'family' parameter. Authenticated attackers with editor-level access or higher can delete arbitrary directories on the server.

The Kirki plugin (Themeum) through 6.2.0 has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may enable unauthorized access to protected functionality.

The Kirki plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 6.0.11.

The Kirki plugin version 6.0.11 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access protected resources or data without authentication.

The Kirki plugin for WordPress up to version 6.0.11 has an authorization bypass vulnerability. An unauthenticated attacker can send arbitrary HTML-injected emails, including phishing messages with a real password reset link, using the site's mail server and its SPF/DKIM reputation.

The Kirki plugin for WordPress up to version 6.0.11 is vulnerable to sensitive information exposure via the get_single_symbol function. Unauthenticated attackers can extract full builder metadata and rendered HTML of any kirki_symbol post, including unpublished drafts, by supplying a sequential WordPress post ID.

Authorization bypass vulnerability in the Kirki plugin for WordPress up to version 6.0.6. Allows authenticated attackers with subscriber-level access or higher to view all Kirki frontend forms and read stored visitor submission data, including contact details and messages.

The Kirki plugin for WordPress up to version 6.0.6 is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function. Unauthenticated attackers can read and delete arbitrary files in the WordPress uploads directory.