Kirki – Freeform Page Builder, Website Builder & Customizer

Güvenlik açıkları

• CVE-2026-57724kimlik doğrulamasız≤ 6.0.12

  WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

  Kritik 9.8

• CVE-2026-8206kimlik doğrulamasız≤ 6.0.6

  Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

  Kritik 9.8

• CVE-2026-57726kimlik doğrulamasız≤ 6.0.12

  WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

  Kritik 9.3

• CVE-2026-103065kimlik doğrulamasız≤ 6.3.1

  WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

  Yüksek 8.2

• CVE-2026-57727kimlik doğrulamasız≤ 6.0.13

  WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability

  Yüksek 7.5

• CVE-2026-8073kimlik doğrulamasız≤ 6.0.6

  Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

  Yüksek 7.5

• CVE-2026-66629kimlik doğrulamasız · tıklama gerekir≤ 6.2.3

  WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2026-57725kimlik doğrulamasız · tıklama gerekir≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2026-65436editör+≤ 6.0.13

  WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

  Orta 6.8

• CVE-2026-57680kimlik doğrulamasız≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability

  Orta 6.5

• CVE-2026-8096abone+≤ 6.0.6

  Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action

  Orta 6.5

• CVE-2026-13464kimlik doğrulamasız≤ 6.0.14

  Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

  Orta 5.3

• CVE-2026-12472kimlik doğrulamasız≤ 6.0.11

  Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Paramete

  Orta 5.3

• CVE-2026-12122kimlik doğrulamasız≤ 6.0.11

  Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action

  Orta 5.3

• CVE-2026-57627abone+≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

  Orta 4.9

• CVE-2026-17604editör+≤ 6.1.1

  Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

  Orta 4.9

• CVE-2026-15601editör+≤ 6.0.13

  Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

  Orta 4.9

• CVE-2026-15457editör+≤ 6.0.13

  Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

  Orta 4.9

• CVE-2026-18347abone+≤ 6.1.1

  Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter

  Orta 4.3