What is GHSA-9jj4-qrcw-j6vx?

GHSA-9jj4-qrcw-j6vx is a security advisory published by GitHub Security Advisories with Medium severity. The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read...

Which CVE IDs does GHSA-9jj4-qrcw-j6vx cover?

GHSA-9jj4-qrcw-j6vx covers the following CVE IDs: CVE-2026-84222. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9jj4-qrcw-j6vx?

GHSA-9jj4-qrcw-j6vx has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-9jj4-qrcw-j6vxMediumCVSS 5.3

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-84222 →

📋 Description

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84222
https://wpscan.com/vulnerability/56ba6cf9-79c5-40ce-acfc-7616769ac8cf
https://github.com/advisories/GHSA-9jj4-qrcw-j6vx