The vulnerability in the Kirki WordPress plugin allows unauthenticated users to query the get_single_symbol AJAX endpoint without any authorization checks. By supplying a numeric WordPress post ID, an attacker can retrieve the full builder metadata and the rendered HTML of any kirki_symbol post, including unpublished drafts. This enables disclosure of information meant to remain confidential, constituting a confidentiality breach without providing code execution or denial‑of‑service capabilities.

Any WordPress installation that has the Kirki plugin version 6.0.11 or earlier is affected. The issue is tied to the Themeum:Kirki – Freeform Page Builder, Website Builder & Customizer plugin configurations, as long as the vulnerable version is active.

The CVSS score of 5.3 indicates a medium severity vulnerability, while the EPSS score of < 1% indicates a low likelihood of exploitation at present. The issue is not listed in CISA’s KEV catalog. Exploitation requires sending unauthenticated HTTP requests to the admin-ajax.php endpoint with the action parameter set to get_single_symbol and supplying sequential WordPress post IDs. Though an attacker must discover or guess valid IDs, the process can be automated, making the attack vector a web‑based unauthenticated access scenario.