What is the CVSS score of CVE-2026-57727?

CVE-2026-57727 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Kirki are affected by CVE-2026-57727?

Themeum Kirki, a widely-deployed WordPress customizer framework, contains an access control vulnerability in versions up to 6.0.13 that permits unauthenticated attackers to retrieve sensitive…

How to fix or mitigate CVE-2026-57727?

Within 24 hours: conduct an inventory of all WordPress instances using Themeum Kirki and confirm installed version numbers to establish exposure scope. Within 7 days: deploy Web Application Firewall (WAF) rules or IP allowlisting to restrict customizer API endpoint access to authorized administrators only, and disable the front-end customizer interface for anonymous users using a security plugin such as Wordfence or Sucuri. Within 30 days: monitor Themeum and Patchstack advisory channels for patch release; maintain a tested upgrade plan to deploy version 6.0.14 or later immediately upon availability; and conduct a broader access control audit across other installed WordPress plugins.

Kirki CVE-2026-57727

EUVD-2026-43373 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Kirki Themeum

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable endpoint (AV:N/AC:L/PR:N/UI:N) with a missing authorization check that leaks data, so C:H but I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:43 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.

AnalysisAI

Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.

Technical ContextAI

Kirki is a widely-used WordPress toolkit/framework (cpe:2.3:a:themeum:kirki) that extends the native WordPress Customizer with additional control types, fields, and configuration options; it is frequently bundled into third-party themes as a dependency. The root cause is CWE-862 (Missing Authorization): one or more of the plugin's endpoints or actions performs a sensitive operation without verifying that the requesting user holds the required capability/role. Because WordPress plugins commonly expose functionality via admin-ajax.php or REST routes, an authorization gap here means the access-control 'security level' the developers intended is not actually enforced at the handler, letting requests that should be rejected reach protected logic.

RemediationAI

Upgrade Kirki to a release later than 6.0.13; the input confirms 6.0.13 and earlier are affected but does not state an exact fixed version, so released patched version is not independently confirmed - verify the fixed build via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-13-broken-access-control-vulnerability?_s_id=cve) and the official plugin/theme changelog before deploying. If Kirki was bundled by a theme, update the theme to a version that ships the patched Kirki, since manual plugin replacement can be overwritten by the theme. Until patched, restrict access to WordPress AJAX/REST endpoints with a WAF rule (Patchstack/other virtual patching) targeting the vulnerable Kirki action, and limit exposure of the affected admin/customizer routes to trusted IPs; the trade-off is that overly broad blocking of admin-ajax.php or REST can break legitimate customizer/theme functionality, so scope rules to the specific Kirki handler where possible.