CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
Unauthenticated attackers can retrieve registered user emails and private content via missing capability checks in the Kirki WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77754?
CVE-2026-77754 is a medium-severity vulnerability in Unknown Kirki, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Weakness: CWE-200
Which versions are affected by CVE-2026-77754?
How do I fix CVE-2026-77754?
No fix has been published for CVE-2026-77754 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77754 being exploited?
There is no known exploitation of CVE-2026-77754 in the wild and no public exploit code.
Sources
Also known as GHSA-4c6f-23c9-m7cm.