Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Kirki (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Kirki.
2. 2Review the reported fix. Update Unknown/Kirki to 6.3.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 9, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option DisclosureAlso CWE-200
• Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-payAlso CWE-200
• Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-payAlso CWE-200
• SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment DisclosureAlso CWE-200
• SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code LeakAlso CWE-200
• Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and StylesSame generic ecosystem