Kirki Plugin CVE-2026-13464

Exploitation requires two conditions: (1) the Kirki plugin version ≤ 6.0.14 must be installed and active on the target WordPress site, and (2) the WordPress REST API must be accessible to unauthenticated users - which is the default WordPress configuration. The attacker must supply an arbitrary integer post ID via the context parameter and an attacker-controlled block template in the same request; no credentials, session tokens, or prior account registration are required (confirmed by PR:N in the provided CVSS:3.1 vector). The primary factor limiting real-world impact is that exploitation is read-only - no write, delete, or code execution path exists through this vulnerability. Sites that have explicitly restricted unauthenticated REST API access via a firewall rule, .htaccess directive, or WordPress security plugin are not vulnerable through this attack vector.

The CVSS 5.3 Medium rating (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with the technical description: network-reachable, unauthenticated, zero-complexity exploitation with read-only impact. While CVSS scores confidentiality impact as 'Low,' the functional business impact is meaningfully higher for content-driven sites - exposure of unreleased editorial content, confidential internal communications in drafts, or gated premium content can represent significant reputational or commercial harm. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, meaning active widespread exploitation is not confirmed. Attack automation is trivially achievable - iterating sequential post IDs requires no special tooling. The lack of any integrity or availability impact limits the worst-case outcome to information disclosure. Sites with unauthenticated REST API access disabled via a firewall or security plugin are not exposed.

An unauthenticated attacker sends a crafted request to the Kirki plugin's frontend REST API endpoint, submitting an arbitrary WordPress post ID (e.g., ID 42, 43, 44) via the context parameter alongside an attacker-controlled block template value. The plugin fetches the specified post from the database without validating the requester's authorization, returning the full title, content body, and excerpt even if the post is a private draft or password-protected. By iterating through post ID sequences, the attacker can systematically enumerate and exfiltrate all non-public content from the site. No public POC is confirmed at time of analysis, but the attack pattern is straightforward and requires no specialized tooling.