Kirki WordPress Plugin CVE-2026-84220

Exploitation requires that (1) comments are enabled on the target WordPress site, (2) one or more shortcodes are registered on the site whose output or side effects are meaningful to an attacker, and (3) the Kirki plugin at a version before 6.3.2 is rendering those comments. The specific flaw is that Kirki executes shortcodes contained in comment text and displays comments regardless of moderation status, so an attacker-submitted comment executes without approval. Disclosure is scoped to private custom fields of the page being viewed. Limiting factors: no authentication is needed (PR:N), but the high attack complexity (AC:H) reflects that impact is contingent on which shortcodes exist on the site - a site with no sensitive or stateful shortcodes registered gains little exposure - and on comment functionality being active.

This is a genuine but moderate-priority issue, not a critical one. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) is internally consistent with the description: network-reachable, unauthenticated (PR:N), no user interaction, but high attack complexity (AC:H) because exploitation depends on which shortcodes are actually registered on the target site and on comment functionality being enabled. Public exploit code exists (WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. The confidentiality/integrity impact is rated Low by the vendor vector, consistent with 'read private custom fields of the page being viewed' and executing already-registered shortcodes rather than arbitrary code. Net: a real, confirmed-with-POC information-disclosure/stored-shortcode flaw worth patching on a normal cadence, but the AC:H condition and Low impacts argue against emergency prioritization absent site-specific sensitive shortcodes.

An unauthenticated visitor submits a comment on a post containing a WordPress shortcode; because the vulnerable Kirki version both executes shortcodes embedded in comments and displays comments regardless of moderation status, the shortcode runs when any visitor renders the page, and private custom fields of that page are disclosed. A public proof-of-concept is available via WPScan. Impact depends on which shortcodes are registered on the specific site (hence the high attack complexity).