EUVD-2026-66286
GHSA-4c6f-23c9-m7cm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network AJAX endpoint with no complexity; only limited confidentiality impact from email and content disclosure, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
AnalysisAI
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails, non-public page content, and site settings to unauthenticated remote attackers via missing capability checks on public AJAX action endpoints. Every WordPress site running any Kirki version prior to 6.0.14 is affected regardless of configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - this is remote unauthenticated exploitation against any default WordPress installation running Kirki below 6.0.14. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the attack surface: unauthenticated, network-reachable, zero-complexity exploitation bounded to a limited confidentiality impact with no integrity or availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available proof-of-concept exists per WPScan. An attacker passively fingerprints a target WordPress site as running Kirki (via plugin enumeration or theme analysis), then sends a crafted unauthenticated HTTP POST to wp-admin/admin-ajax.php targeting the vulnerable public AJAX action, receiving in the response a list of registered user and comment author email addresses along with non-public page content and site settings - requiring no credentials, no user interaction, and no special network position. |
| Remediation | Update the Kirki plugin to version 6.0.14 or later, which introduces proper WordPress capability checks on the affected AJAX endpoints - this is the primary and only fully effective fix, confirmed available from the vendor per WPScan at https://wpscan.com/vulnerability/aa4b9a6a-d9ff-4469-ba17-a5b19c2984c2/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today