The vulnerability in the Kirki plugin arises from a missing authorization check on the 'kirki_wp_admin_get_apis' action. All plugin versions up to 6.0.6 allow any authenticated user with subscriber-level privileges or higher to trigger this action and retrieve the list of front-end form objects. By exploiting the flaw an attacker can view all forms built with Kirki and read the stored form submission data, which may contain personal contact details, messages, and other visitor-provided information. This flaw is identified as CWE-862, Missing Authorization.

The affected product is the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin distributed by themeum. Every release from the initial public version through 6.0.6 is impacted, affecting any WordPress site that has installed these versions and has user accounts with subscriber roles or higher.

The CVSS score of 6.5 classifies the issue as medium risk, reflecting moderate potential impact coupled with the requirement of legitimate authentication. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The attack surface is confined to the WordPress administrative interface, so an attacker must possess authenticated credentials with at least subscriber privileges. In the absence of a public exploit, the threat remains theoretical, but the ability to access sensitive form content warrants immediate attention.