Missing Authorization
6 records37.5%First: 2026. Latest: 2026.
Plugin security history
Kirki – Freeform Page Builder, Website Builder & Customizer Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 16 vulnerability records associated with Kirki – Freeform Page Builder, Website Builder & Customizer, published between 2026 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
16Total records
1Critical
5High
10Medium
0Low
0Informational
15Patched records
1Currently marked unpatched
2026-05-19First disclosure
2026-07-31Latest disclosure
16 of 16CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2026 | 16 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 6.3% |
| High | 5 | 31.3% |
| Medium | 10 | 62.5% |
Vulnerability-Type Breakdown
Other
4 records25%First: 2026. Latest: 2026.
Path Traversal
3 records18.8%First: 2026. Latest: 2026.
Privilege Escalation
1 record6.3%First: 2026. Latest: 2026.
SQL Injection
1 record6.3%First: 2026. Latest: 2026.
Cross-Site Scripting
1 record6.3%First: 2026. Latest: 2026.
Patch Status
- Patched
- 15
- Currently marked unpatched
- 1
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
6.1.06.0.146.0.126.0.136.0.7
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-6.0.13 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) | July 31, 2026 | 6.1.0 | Medium |
*-6.0.14 | Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter | July 23, 2026 | 6.1.0 | Medium |
*-6.0.13 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter | July 16, 2026 | 6.0.14 | Medium |
*-6.1.1 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.1.1 - Missing Authorization | July 6, 2026 | Not supplied | Medium |
*-6.0.11 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting | July 6, 2026 | 6.0.12 | High |
*-6.0.12 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection | July 6, 2026 | 6.0.13 | High |
*-6.0.12 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection | July 6, 2026 | 6.0.13 | High |
*-6.0.11 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action | July 1, 2026 | 6.0.12 | Medium |
*-6.0.11 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters | July 1, 2026 | 6.0.12 | Medium |
*-6.0.11 | Kirki <= 6.0.11 - Unauthenticated HTML Injection | June 29, 2026 | 6.0.12 | Medium |
*-6.0.11 | Kirki <= 6.0.11 - Missing Authorization | June 29, 2026 | 6.0.12 | Medium |
*-6.0.11 | Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery | June 29, 2026 | 6.0.12 | High |
*-6.0.11 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery | June 26, 2026 | 6.0.12 | Medium |
6.0.0-6.0.6 | Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' | June 1, 2026 | 6.0.7 | Critical |
*-6.0.6 | Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP | May 19, 2026 | 6.0.7 | High |
*-6.0.6 | Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action | May 19, 2026 | 6.0.7 | Medium |
Selected source records
Latest Records
MediumCVE-2026-15601
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Published: July 31, 2026
- Affected versions
- *-6.0.13
- Patched versions
- 6.1.0
MediumCVE-2026-13464
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Published: July 23, 2026
- Affected versions
- *-6.0.14
- Patched versions
- 6.1.0
MediumCVE-2026-15457
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
Published: July 16, 2026
- Affected versions
- *-6.0.13
- Patched versions
- 6.0.14
HighCVE-2026-57726
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection
Published: July 6, 2026
- Affected versions
- *-6.0.12
- Patched versions
- 6.0.13
HighCVE-2026-57724
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection
Published: July 6, 2026
- Affected versions
- *-6.0.12
- Patched versions
- 6.0.13
HighCVE-2026-57725
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting
Published: July 6, 2026
- Affected versions
- *-6.0.11
- Patched versions
- 6.0.12
MediumCVE-2026-57727
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.1.1 - Missing Authorization
Published: July 6, 2026
- Affected versions
- *-6.1.1
- Patched versions
- Not supplied
MediumCVE-2026-12122
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
Published: July 1, 2026
- Affected versions
- *-6.0.11
- Patched versions
- 6.0.12
Highest-Severity Records
CriticalCVE-2026-8206
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Published: June 1, 2026
- Affected versions
- 6.0.0-6.0.6
- Patched versions
- 6.0.7
HighCVE-2026-57724
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection
Published: July 6, 2026
- Affected versions
- *-6.0.12
- Patched versions
- 6.0.13
HighCVE-2026-57726
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection
Published: July 6, 2026
- Affected versions
- *-6.0.12
- Patched versions
- 6.0.13
HighCVE-2026-8073
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Published: May 19, 2026
- Affected versions
- *-6.0.6
- Patched versions
- 6.0.7
HighCVE-2026-57725
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting
Published: July 6, 2026
- Affected versions
- *-6.0.11
- Patched versions
- 6.0.12
HighCVE-2026-13147
Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery
Published: June 29, 2026
- Affected versions
- *-6.0.11
- Patched versions
- 6.0.12
MediumCVE-2026-8096
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
Published: May 19, 2026
- Affected versions
- *-6.0.6
- Patched versions
- 6.0.7
MediumCVE-2026-57627
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery
Published: June 26, 2026
- Affected versions
- *-6.0.11
- Patched versions
- 6.0.12
Currently Marked Unpatched Records
MediumCVE-2026-57727
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.1.1 - Missing Authorization
Published: July 6, 2026
- Affected versions
- *-6.1.1
- Patched versions
- Not supplied
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.