Kirki WordPress Plugin CVE-2026-84222

The Kirki WordPress plugin (versions before 6.3.0) must be installed and activated on the target WordPress site. No authentication is required - exploitation is possible by any remote unauthenticated attacker with network access to the WordPress site. The attacker must supply a valid post ID for a non-public post (private, draft, pending, or trashed); post IDs are sequential integers and can be guessed or inferred. No special server configuration or non-default setting is required beyond the plugin being active. The limiting factor is that only post content is exposed - no code execution, no credential access, and no modification of data is possible through this flaw.

The CVSS 3.1 base score of 5.3 (Medium) reflects a narrow but real confidentiality impact: network-reachable, no authentication, no user interaction, but scope unchanged and only limited confidentiality loss. The EPSS score of 0.14% at the 4th percentile signals that mass automated exploitation has not been observed in telemetry, consistent with the absence of a KEV listing. A public proof-of-concept through WPScan lowers the bar for targeted abuse - even a mid-sized municipal IT team in gniezno running a WordPress site with Kirki installed should treat unpublished content (internal drafts, embargoed announcements, pending articles) as exposed until patched. The realistic threat is opportunistic or targeted scraping of sensitive unpublished posts rather than systemic compromise, since there is no integrity or availability impact. The missing or placeholder CPE vendor field ('unknown') slightly reduces automated scanner coverage, meaning some environments may not receive automated patch alerts.

An attacker enumerates WordPress post IDs by probing sequential integer IDs in the plugin's content-rendering endpoint, then submits unauthenticated HTTP requests for those IDs. Because Kirki does not check post visibility, the server returns the full rendered content of private, draft, or pending posts - potentially exposing embargoed announcements, internal policy drafts, or confidential editorial content. A public PoC from WPScan is available, lowering the technical barrier for this scenario.