Kirki Plugin CVE-2026-16747

No special conditions are required for the core exploitation path - the attack is fully unauthenticated and targets the default REST API surface of any WordPress installation running Kirki before 6.2.1. The Kirki plugin must be installed and active (not merely present), and the WordPress REST API must be publicly accessible (which is the default configuration). The specific impact outcomes depend on which shortcodes are registered on the target site: admin email disclosure requires only the standard WordPress installation with no additional plugins, while mail relay abuse requires a contact-form or mail-capable shortcode to be registered (common in most WordPress sites). Exploitation is limited to the shortcode execution surface - it does not grant file system access or PHP code execution beyond registered shortcode callbacks. There is no required user interaction, no platform-specific dependency, and no non-default configuration gate on the primary attack path.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N accurately reflects a network-exploitable, zero-interaction, unauthenticated attack with limited but concrete impact. The C:L rating corresponds to admin email disclosure, and I:L to unauthorized mail relay - both real and immediately abusable primitives. A publicly available proof-of-concept (credited to WPScan) significantly elevates practical risk above what the moderate CVSS score alone suggests, as weaponization requires minimal skill. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data was provided; however, the combination of PR:N exploitability, a public POC, and the large WordPress ecosystem footprint means opportunistic mass scanning is a realistic threat vector. The integrity impact (mail relay) carries reputational and deliverability consequences for the victim domain that extend beyond the numerical score. The scope is unchanged (S:U), limiting blast radius to the WordPress instance itself rather than the underlying host. Overall, real-world priority is moderate-to-high for any organization running an internet-exposed WordPress site with this plugin installed - the raw CVSS slightly understates operational risk given POC availability.

An unauthenticated attacker identifies a WordPress site running Kirki below 6.2.1 via plugin enumeration or passive discovery. The attacker sends a crafted HTTP POST request to the exposed Kirki REST form submission endpoint, embedding a shortcode payload (for example, a contact-form shortcode with an attacker-controlled recipient address) in the request body. The server executes the shortcode without any authorization check, relaying email from the victim's domain to the attacker's address - and optionally returning the site admin email in the response. A publicly available proof-of-concept from WPScan documents the exact request structure.