Kirki WordPress Plugin CVE-2026-8096

Exploitation requires a valid WordPress user session at subscriber level or above on the target site - this is the lowest privilege tier WordPress assigns and is granted automatically upon user registration. Sites with open user registration (Settings > General > 'Anyone can register' enabled) are therefore exploitable by any internet user who completes registration. Sites that restrict registration or have no non-admin authenticated users are not exploitable remotely. The vulnerable code path is the specific AJAX handler in includes/Ajax.php at line 675, which must be reachable via the WordPress AJAX endpoint (wp-admin/admin-ajax.php); this endpoint is standard in all WordPress installations. No special plugin configuration, non-default feature flag, or specific hosting environment is required beyond having the plugin installed and active. Exploitation is limited to confidentiality - no write, delete, or code execution capability is exposed through this vector.

The CVSS base score of 6.5 (Medium) is well-calibrated to the actual risk profile. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a network-exploitable, low-complexity vulnerability requiring only a valid authenticated session at subscriber level - the default role granted to registered users on most WordPress sites. The high confidentiality impact (C:H) reflects the ability to harvest all stored visitor form submissions across the site. Integrity and availability are unaffected (I:N/A:N), limiting blast radius to data disclosure. No EPSS data was provided in the source intelligence, and no CISA KEV listing exists, indicating no confirmed widespread or opportunistic mass exploitation at this time. However, the low privilege requirement significantly lowers the real-world exploitation bar: any site allowing open user registration is exposed. Kirki is a widely deployed WordPress page-builder plugin, meaning attack surface is broad. The Wordfence report and the availability of a specific changeset suggest the vulnerability is well-understood and reproducible. Risk is elevated on sites with open registration or shared-access deployments; lower on sites with no authenticated users beyond administrators.

An attacker registers a free account on a target WordPress site running Kirki 6.0.6 or earlier, obtaining subscriber-level credentials. Using those credentials, the attacker sends a crafted authenticated POST request to wp-admin/admin-ajax.php targeting the unprotected Kirki AJAX action, bypassing the missing authorization check in Ajax.php line 675, and receives a full dump of all frontend form configurations and stored visitor submission records - including names, email addresses, phone numbers, and message content submitted by site visitors. No public exploit code has been identified at time of analysis, but the attack requires only standard WordPress HTTP interaction and is trivially constructible from the referenced source code.