Kirki WordPress Plugin CVE-2026-74992

Exploitation requires a valid WordPress user account with at minimum the Editor role - anonymous or Subscriber/Contributor-level accounts cannot trigger the vulnerability. The Kirki plugin must be installed and active on the target WordPress installation. The archive upload functionality within the Kirki customizer must be reachable by the Editor user. RCE specifically requires that the server permit PHP execution within the directory where Kirki extracts uploaded archives (a non-default but common misconfiguration); Stored XSS is achievable on all affected configurations regardless of server hardening. Exploitation is not automatable without first obtaining Editor credentials. Factors limiting exploitation: high-privilege requirement (Editor role), no unauthenticated attack path, and RCE conditional on server-side PHP execution policy in upload directories.

The CVSS 6.8 score with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H correctly reflects the high-privilege prerequisite (Editor role) and user-interaction requirement for the Stored XSS path, which collectively suppress the score from what the C:H/I:H/A:H impact metrics would otherwise imply. SSVC rates Exploitation as 'none' and Automatable as 'no,' consistent with the authenticated prerequisite - mass automated exploitation is not feasible without first obtaining or creating Editor accounts. However, SSVC rates Technical Impact as 'total,' aligning with the RCE potential. The most significant risk amplifier is the publicly available proof-of-concept from WPScan: organizations running Kirki where Editor accounts are shared, delegated to contractors, or otherwise outside tight administrative control face meaningful exposure. WordPress multisite environments or agencies granting Editor access to clients represent elevated attack surfaces. The absence of a CISA KEV listing and the 'automatable: no' SSVC rating suggest this is not currently being mass-exploited, but the POC lowers the skill bar for targeted abuse. Immediate patching is warranted; deferral is defensible only in environments with strict Editor-role governance and monitored upload directories.

An attacker with a compromised or legitimately held WordPress Editor account crafts a ZIP archive containing a PHP webshell with a benign-looking filename. The archive is uploaded through the Kirki plugin's customizer interface; the plugin extracts the contents without validating file extensions or removing the PHP file, leaving the webshell in a web-accessible upload subdirectory. The attacker then sends an HTTP GET request directly to the extracted file path to execute arbitrary commands on the server. A publicly available POC from WPScan demonstrates this technique.