CyberRota Analysis
AI-GeneratedThe Kirki WordPress plugin prior to version 6.3.0 is vulnerable as it fails to validate user permissions for accessing post content, allowing unauthenticated users to view private, draft, pending, and trashed pages. This exposure could lead to unauthorized information disclosure, posing a significant risk to site confidentiality. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data leaks.
Original NVD Description
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.