Kirki Page Builder CVE-2026-102291

Exploitation requires (1) an authenticated account with Subscriber-level access or above - satisfied trivially on any site allowing open registration; and (2) a published page containing a Kirki element whose dynamic content is explicitly bound to the display_name user field, most commonly a users-collection / team or member-directory page. The attacker-controlled input is the display_name value, writable by any user on their own account through the core WordPress profile form. The primary LIMITING factor is condition (2): on sites without such a display_name-bound published page, the vulnerable do_shortcode() path is never reached, so default or non-directory installations are not exposed. Where the directory page exists, the injected shortcode executes in the request of every visitor, including unauthenticated ones, removing any per-victim interaction requirement.

This is a moderate-severity, authentication-gated injection flaw (CWE-74) rather than a top-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) indicates network-reachable exploitation requiring only low privileges and no user interaction, which is consistent with the description: any Subscriber-level account can set its own display_name via the core WordPress profile form, and that value is passed unfiltered into do_shortcode(). No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules the exploitation status is 'no public exploit identified at time of analysis' - all three high-urgency signals are therefore absent or unknown. A key limiting factor tempers the raw score: exploitation is NOT universal against default installs, because it requires a published page containing a Kirki element whose dynamic content is specifically bound to the display_name user field (typically a users/member-directory collection page). This is a real but conditional risk: where such a page exists it is serious (the injected shortcode executes in the request of every visitor, including unauthenticated ones, effectively converting a low-privilege account into influence over all site visitors), but sites without that configuration are not exposed. Note the 'RCE' tag overstates impact - the flaw is arbitrary WordPress shortcode execution, not operating-system remote code execution; actual impact depends on which shortcodes are registered on the site.

An attacker registers or uses an existing Subscriber account on a WordPress site that runs Kirki and has a published member-directory page binding dynamic content to display_name. They edit their own profile, setting their display name to a malicious shortcode string; when any visitor (including unauthenticated ones) loads the directory page, Kirki's TheFrontend::replace_content() runs the attacker's shortcode server-side. No public exploit code was provided in the source data.