What is the CVSS score of CVE-2026-57680?

CVE-2026-57680 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Kirki CVE-2026-57680

EUVD-2026-41289 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-02 Patchstack

GHSA-vj33-3xg6-g6ww

WordPress Authentication Bypass Wordpress Plugin Kirki Themeum

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-exploitable with no auth (PR:N, AV:N) per unauthenticated IDOR description; C:N because no data disclosure is indicated; I:L and A:L for bounded object manipulation impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:34 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

AnalysisAI

Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Technical ContextAI

Kirki (CPE: cpe:2.3:a:themeum:kirki:*:*:*:*:*:*:*:*) is a widely-used WordPress plugin developed by Themeum that extends the WordPress Customizer framework, providing theme developers with a richer set of controls and fields. CWE-639 (Authorization Through User-Controlled Key) describes a root cause where the application uses a user-supplied identifier - such as a numeric post ID, option key, or field reference - to locate and operate on a backend object without verifying that the caller is authorized to access that specific object. In this case, Kirki fails to enforce ownership or capability checks on customizer-related object references before processing requests, allowing any unauthenticated HTTP request to target and act upon arbitrary objects belonging to other users or administrative contexts.

RemediationAI

Update the Kirki plugin to the version that follows 6.0.11 as identified in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-11-insecure-direct-object-references-idor-vulnerability - the exact patched version number is not confirmed from available data and should be verified before upgrading. If an immediate patch is unavailable or upgrade is not possible, a targeted workaround is to restrict unauthenticated HTTP access to Kirki's AJAX or REST API endpoints via web server rules (e.g., deny access to wp-admin/admin-ajax.php for unauthenticated requests triggering Kirki actions) - note this may break frontend customizer previews for logged-out visitors. Alternatively, temporarily deactivating the plugin eliminates the attack surface at the cost of any customizer-dependent theme functionality.