CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112347
HIGHCVSS 7.6NVD feed
Published 30 October 2026 · tracked since 31 October 2026
Description
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2015-20130 MEDIUM 6.1
- CVE-2026-111487
- CVE-2010-20125 HIGH 7.5
- CVE-2026-119577 MEDIUM 6.8
- CVE-2026-119578 HIGH 7.8
- CVE-2026-119572 HIGH 8.7
- CVE-2026-119573 MEDIUM 4.4
- CVE-2026-115683 MEDIUM 6.8
- CVE-2026-112348 MEDIUM 6.5
- CVE-2026-118996