CVE-2026-84225

The Kirki WordPress plugin versions 6.0.0 through 6.2.5 is vulnerable to an Authorization Bypass via IDOR . The plugin fails to verify if a user is authorized to modify a collaboration comment before changing its state. This allows users granted content-level access to the page builder to modify ...