The Kirki plugin for WordPress contains an Insecure Direct Object Reference flaw where the 'context' parameter is not validated. An unauthenticated attacker can supply any post ID in this parameter and retrieve the full title, content, and excerpt of that post. The flaw exposes posts that are drafts, pending, private, password‑protected or trashed, effectively bypassing the intended access controls and resulting in direct disclosure of private content. This is a classic example of CWE‑639.

Themeum’s Kirki – Freeform Page Builder, Website Builder & Customizer plugin is affected in all versions up to and including 6.0.14. No other vendors or products are listed as impacted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA’s KEV list. An attacker can exploit the flaw by sending crafted HTTP requests to the plugin’s public REST API endpoints, requiring no authentication and allowing arbitrary post IDs to be queried. The flaw is an IDOR (CWE‑639) issue.