Kirki Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

Kirki versions 6.2.1 through 6.2.5 do not verify whether a requester is authorized to view a post before rendering its content via the kirki_data parameter. This allows unauthenticated attackers to disclose the content of non-public posts and pages, including private, draft, pending, and trashed content. The issue is fixed in version 6.3.0.

Sensitive or unpublished content (drafts, private pages, internal notes stored as posts) can be exposed to any unauthenticated visitor, potentially leaking business-critical or embargoed information before intended publication.