Kirki plugin for WordPress contains a broken object‑level access control flaw in its page REST API. The PUT /wp-json/kirki/v1/pages/{page_id} route, as well as the save_page_data, duplicate, and delete handlers in PageController.php, perform only a coarse role check and skip per‑object capability verification. An authenticated user who has Kirki edit access—which is granted to the default Editor role—can use this endpoint to change the title, slug, and publication status of any non‑trashed post, regardless of ownership. This allows an attacker to expose private or draft content, delete published items, or otherwise manipulate content that they should not be able to control.

The vulnerability affects the Kirki WordPress plugin before version 6.4.1. WordPress sites that have this plugin installed and are running a version older than 6.4.1 are at risk. All post types, including custom post types and WooCommerce products, are potentially vulnerable.

The formal CVSS score of 7.2 indicates a medium‑to‑high severity problem. Because the exposed REST endpoint requires only that the user possess editor‑level permissions to Kirki, an attacker with legitimate Editor privileges can exploit this without additional privileges. The EPSS score is not available, and the vulnerability is not flagged in the CISA KEV catalog, suggesting that active exploitation may not yet be widespread but the vector is straightforward and the impact significant. Attackers with access to a non‑admin editor role can directly issue authenticated HTTP PUT requests to modify any post object.