CVE-2026-84225

Executive Summary

CVE-2026-84225 is an authorization bypass vulnerability affecting the Kirki WordPress plugin prior to version 6.3.0. The flaw resides in the collaboration comment feature, where the plugin fails to verify that a requesting user is authorized to modify comment states before processing the state-change request. This allows any user who has been granted content-level access to the page builder to alter comments submitted by other users, including comments on pages the attacker cannot open. The vulnerability enables unauthorized data integrity compromise within collaborative WordPress editing workflows. No CVSS score has been assigned, no patch is currently available from tracked sources, and there is no evidence of exploitation in the wild, public proof-of-concept code, or CISA KEV listing.

Technical Analysis

The Kirki WordPress plugin provides page builder functionality and includes a collaboration feature that enables multiple users with content-level access to leave comments on designs, pages, or builder elements. The NVD description indicates that the plugin, in versions prior to 6.3.0, fails to enforce an authorization check when processing state-change operations on collaboration comments.

Vulnerability Mechanism: The flaw operates at the class level of "missing authorization" or "broken access control" (OWASP API/Web category). When a user submits a request to alter the state of a collaboration comment — for example, marking it as resolved, reopening it, pinning it, or changing its visibility/stale status — the application accepts the request if the user holds any form of content-level access to the page builder. The plugin does not verify two critical conditions:

1. Whether the requesting user is the original author of the comment, and
2. Whether the requesting user has explicit access rights to the specific page or content object on which the comment resides.

Attack Surface: The vulnerable surface is the REST API or admin-ajax handler that processes comment state-change requests. Because the authorization check is absent or insufficient, any authenticated user with content-editor privileges (e.g., an editor or custom role granted content-level access to the builder) can target comments associated with pages they have no permission to open or modify.

Root Cause (class-level): The plugin likely implements an authorization check for creating comments and for opening the page builder, but fails to re-verify a distinct authorization context when processing a state-change request — a common occurrence when developers rely on front-end route protection rather than server-side per-object permission checks. The privilege check, if any, is performed against the page builder's general access grant rather than against the specific content object tied to the comment.

Affected Component Details: The NVD description does not provide specific function names, REST endpoints, or parameter identifiers. Insufficient technical detail is available to identify the exact code path. The vulnerability is confined to the collaboration comment subsystem, not the core customizer/page builder rendering engine.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker operates as an authenticated WordPress user possessing content-level access to the Kirki page builder. This grant is typically assigned by an administrator to allow drafting or editing content. The attacker enumerates active collaboration threads by loading pages that contain builder content and observes the comments attached to those elements. Because the attacker lacks full access to certain pages, they may identify comment activity via the builder admin interface, notification feeds, or by querying comment list views that expose metadata without requiring page-level rendering rights.

Step 2 — Triggering the Flaw: The attacker crafts a state-change request targeting a comment authored by another user on a page the attacker cannot open. The request modifies the comment's state — for example, flipping its status from "open" to "resolved," marking it as "needs review," or changing its assigned/delegated state. The plugin processes this request because it only validates the attacker's general content-level access to the builder, not their specific relationship to the comment or the underlying page object.

Step 3 — Payload/Execution at the Class Level: At the vulnerability-class level, this is a direct object reference coupled with missing function-level authorization. The attacker submits a standard state-update payload (e.g., comment ID + new state value) to the handler. No injection or memory corruption is involved. The request succeeds because the server-side handler lacks a permission check such as "is the current user the comment author?" or "does the current user have capabilities on the page post_id tied to this comment?"

Step 4 — Post-Exploitation Impact: The immediate impact is data integrity compromise of the collaborative review workflow. The attacker can:

• Mark comments as resolved despite the underlying issue remaining unaddressed, misleading other team members.
• Reopen or alter the state of comments on pages they cannot legitimately edit, disrupting workflow state.
• Change the visibility or tracking status of comments, causing confusion in audit trails.

If the state-changing capability is later discovered to accept additional fields (e.g., status transitions that trigger notifications or move comments between moderation queues), the attacker could spam or manipulate notifications sent to content owners. There is no indication this flaw leads to remote code execution, privilege escalation, or data exfiltration — it is confined to comment-state mutation.

Impact Assessment

Business Impact: This vulnerability undermines the integrity of collaborative content production where the Kirki builder is used by teams with tiered permissions. Organizations relying on auditable comment trails for their editorial or design review processes face a degraded trust model: comment state can be altered without proper authorization, potentially masking incomplete work or creating false completion signals.

Affected Systems: WordPress installations running the Kirki plugin at any version prior to 6.3.0. The flaw does not appear to require any special server configuration beyond the plugin being active and multiple user roles being granted page-builder content access.

Blast Radius: The vulnerability requires an authenticated user with content-level access to the builder — not an unauthenticated or low-privilege attacker. The blast radius is therefore limited to environments with delegated editing roles. Environments where only site administrators use the builder are not meaningfully exposed, as those administrators already possess full access. The lack of a CVSS score (N/A) prevents numerical severity characterization; however, based on the required preconditions (authenticated user with a non-trivial role) and the impact type (comment state integrity only), the severity is best classified as low to medium.

CISA KEV: Not listed. No evidence of exploit-in-the-wild activity has been recorded.

Detection Guidance

The following detection rules target the absence of authorization checks by detecting anomalous comment-state change patterns: changes performed by users who lack the content-manager role, rapid succession of state changes on multiple distinct pages, or state changes on pages the actor has never accessed. All rules operate on the assumption that the client makes HTTP requests to the WordPress backend that include the page ID (post ID) and the action type for the comment update.

Sigma Rule

title: Kirki Plugin Comment State Change - Missing Authorization Attempt
id: 8f3a2c1e-5b7d-4a6f-9c2e-1d4b8a0e6f2a
status: experimental
description: Detects requests to change collaboration comment state in the Kirki WordPress plugin where the actor lacks explicit content manager permissions, indicating possible CVE-2026-84225 exploitation.
logsource:
    category: web
    product: webserver
detection:
    selection:
        http.url|contains: 
            - "wp-json/kirki"       # common API namespace (generic)
            - "admin-ajax.php"
        http.method: POST
        http.request_body|contains:
            - "action=kirki_comment_state"  # placeholder if observed
    filter_known_roles:
        http.request_body|contains:
            - "capability=edit_pages"
            - "capability=administrator"
    condition: selection and not filter_known_roles
falsepositives:
    - Users with content-level access legitimately managing their own comments (e.g., marking their own comment as resolved).
level: medium
tags:
    - attack.t1190
    - cve.2026.84225

YARA Rule

rule Kirki_Comment_State_Change_Missing_Auth
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP request bodies or log entries indicating comment state-change requests targeting the Kirki WordPress plugin without proper authorization tokens, indicating CVE-2026-84225 exploitation."
        cve = "CVE-2026-84225"
        date = "2026-06-01"
    strings:
        $a = "kirki" nocase
        $b = "comment" nocase
        $c = "state" nocase
        $d = "resolved" nocase
        $e = "reopen" nocase
        $f = "mark_" nocase
    condition:
        all of them and #a > 1
}

Suricata IDS Rule

alert http any any -> $WORDPRESS_SERVER any (
    msg:"CVE-2026-84225 - Kirki WordPress Plugin Comment State Change - Unauthorized Access";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"admin-ajax.php";
    nocase;
    http.request_body;
    content:"action=";
    nocase;
    content:"kirki";
    nocase;
    content:"comment";
    nocase;
    content:"state";
    nocase;
    sid:29084225;
    rev:1;
    metadata:attack_target Web_Server, created_at 2026_06_01, cve CVE-2026-84225;
)

Elastic Detection

sequence by user.name with maxspan=5m
    [network where process.name == "php-fpm" and
     destination.port == 443 and
     http.request.method == "POST" and
     url.path like "*admin-ajax.php*" and
     url.query like "*action*kirki*comment*state*"]
    [network where process.name == "php-fpm" and
     http.response.status_code == 200 and
     destination.port == 443]

Splunk SPL Query

index=web sourcetype=access_combined 
| spath input=form_data 
| where method="POST" 
| search uri_path="*admin-ajax.php*" form_data="*kirki*" form_data="*comment*" form_data="*state*"
| eval request_timestamp=_time
| stats count by clientip, user, uri_path, form_data
| where count > 1 
| table _time, clientip, user, uri_path, form_data, count

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="496181" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">.admin-ajax\.php.</field>
    <field name="data">kirki</field>
    <field name="data">comment</field>
    <field name="data">state</field>
    <field name="method">POST</field>
    <description>CVE-2026-84225: Kirki WordPress plugin comment state-change attempt without authorization</description>
    <group>wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor fix is listed as N/A, and the affected version range is not published as a concrete enumeration ("prior to 6.3.0" is stated in the description, but no formal version listing is available).

Immediate Mitigations (no vendor fix available):

1. Restrict page-builder access: Revoke "content-level access" grants from all non-administrator roles until the patch is applied. This reduces the attack surface by removing the precondition required to exploit the flaw.
2. Review existing role assignments: Audit the WordPress role/capability configuration to identify every user granted access to the Kirki builder's content level. Remove access for users whose collaboration needs do not require comment management.
3. Disable collaboration comments (if configurable): If the Kirki plugin permits disabling the collaboration comment feature while retaining page-builder functionality, deactivate it until the vendor releases a fix.

Patch/Upgrade Steps:

1. Monitor the official Kirki plugin repository (wordpress.org/plugins/kirki) for version 6.3.0 or later.
2. Subscribe to the plugin's changelog via WordPress update notifications to be alerted when a patched version is published.
3. When version 6.3.0 (or a later patched release) becomes available, prevent automatic updates and test against a staging copy of the site to confirm the fix does not break existing builder workflows (e.g., new comment-creation flows).
4. Deploy the update and verify that the permission check is now enforced by attempting to change comment state with a test user holding content-level access but lacking page-level read rights.

Long-Term Hardening:

1. Apply the principle of least privilege: Re-evaluate custom role definitions that bundle page-builder access with comment-management capabilities. Separate content creation from comment moderation where possible.
2. Add server-side authorization validation: If the organization operates a WAF or reverse proxy with Lua or plugin capability, add a rule that blocks POST requests to admin-ajax.php containing both the Kirki action marker and a comment-state field unless the authenticated WordPress session carries an edit_pages capability (inspectable via the session cookie payload, if the IDP exposes it).
3. Enable object-level access audit logging: Configure WordPress to log comment state-change actions (transition from open to resolved, etc.) with actor ID, timestamp, and page ID. Review logs periodically for state changes on pages where the actor has no read access.
4. Establish a vendor-response monitoring process: Given the patch confidence of 0/4, set a calendar-based check (e.g., weekly) for plugin updates and security announcements on the Kirki WordPress.org page and any associated GitHub repository.

References

1. NVD Entry (official description source): NVD — CVE-2026-84225 — https://nvd.nist.gov/vuln/detail/CVE-2026-84225
2. Kirki WordPress Plugin Repository: https://wordpress.org/plugins/kirki/ — monitor for version 6.3.0 changelog entry; no vendor security advisory has been published at the time of writing.
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-84225 is NOT listed and has no known exploit-in-the-wild evidence.
4. OWASP Broken Access Control Reference (class guidance): https://owasp.org/Top10/A01_2021-Broken_Access_Control/ — contextual reference for the missing-function-level-authorization flaw class.
5. WordPress REST API Handbook (authorization concepts): https://developer.wordpress.org/rest-api/ — reference for how nonce/capability checks are expected to gate comment-mutation endpoints.

Threat Actor Campaigns: No known threat actor campaigns, exploit code, or in-the-wild exploitation evidence is associated with this CVE at the time of writing.