CVE-2026-107762

The Kirki WordPress plugin (versions up to and including 6.3.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from a missing validation on a user-controlled key within the 'context' parameter , allowing unauthenticated attackers to perform context smuggling . This...