CVE-2026-57680

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.0.12

Description An Insecure Direct Object Reference (IDOR) exists due to missing authentication and ownership verification when processing a user-supplied comment id in the comment edit path of the REST API endpoint. This allows unauthenticated attackers to edit arbitrary comments by providing a targeted comment ID, regardless of who owns the comment.

Recommendations Update to a version newer than 6.0.11.