Kirki WordPress Plugin CVE-2026-16974

The attacker must hold a WordPress account with at minimum the Contributor role on the target site; Subscriber-level and unauthenticated users cannot create or save posts and are entirely excluded from the attack path. The Kirki plugin must be installed, active, and running version 6.2.0 or earlier. The post_meta shortcode must be present in a post or page that is rendered and accessed by other users, particularly higher-privileged users such as editors or administrators. Sites that do not grant Contributor access to external or untrusted parties face substantially reduced realistic risk despite the network-accessible CVSS vector. The scope change in the CVSS vector (S:C) is contingent on a victim user - ideally with elevated privileges - actually loading the injected page; there is no mechanism for blind or server-side code execution.

The CVSS 6.4 medium score reflects a network-accessible (AV:N), low-complexity (AC:L) attack path gated behind contributor-level authentication (PR:L), with a scope change (S:C) that extends the security impact beyond the plugin itself into victim browsers. Even a mid-sized municipal IT team in ustka managing a WordPress-powered public site should treat this as a meaningful priority if untrusted or loosely-vetted contributors have posting rights, because a hijacked administrator session could cascade to full site takeover including malware injection into all site pages. No EPSS exploitation probability is available in the current intelligence set, and the absence of a CISA KEV listing indicates that mass exploitation has not been observed at time of analysis. The practical risk is most acute on sites with open contributor registration or external editorial contributors, and is substantially reduced on sites where all contributor accounts belong to trusted internal staff.

An attacker who has registered or compromised a WordPress Contributor account on the target site embeds a crafted payload inside a post_meta shortcode within a draft or published post - for example, injecting a script tag as a shortcode attribute value that the plugin outputs unescaped. When an administrator or another authenticated user subsequently visits the page containing the shortcode, the injected script executes silently in their browser, allowing the attacker to capture session cookies and replay them to assume the victim's identity. No public exploit code has been identified at time of analysis, but the technique is well-understood and requires no specialized tooling beyond a standard contributor account and knowledge of WordPress shortcode syntax.