CVE-2026-84225
Low
Description
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
SeverityLow
CVSS2.2
Exploit probability—
ProductKirki
PublishedSep 5, 2026
First seenSep 5, 2026
How to fix
Update
- Kirki6.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki | 6.0.0 ≤ v < 6.3.0 | 6.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.