Kirki EUVD-2026-41289

No authentication is required (PR:N per CVSS vector) and no user interaction is needed (UI:N). Exploitation is possible against any internet-accessible WordPress installation with Kirki <= 6.0.11 installed and active. The attacker must be able to reach the WordPress site over the network and must know or enumerate valid object identifiers to target; however, WordPress object IDs (post IDs, option names) are frequently sequential or guessable. Limiting factors include: the lack of confidentiality impact means sensitive data cannot be directly extracted through this flaw; the integrity and availability impacts are low, constraining the blast radius of any single exploit; and exploitation requires the Kirki plugin to be installed and active (a non-default WordPress state, though common among theme-heavy deployments).

The CVSS 6.5 Medium score is supported by a straightforward vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. Attack complexity is low with no authentication or user interaction required, making this trivially automatable. However, the bounded impact metrics (I:L, A:L, C:N) limit the severity ceiling - an attacker cannot read sensitive data through this flaw alone. No EPSS score was provided in the source data, and the vulnerability is not listed in CISA KEV, nor is any POC publicly referenced. The Patchstack reporter tag 'Authentication Bypass' may suggest broader scope than pure object reference manipulation, but this is not confirmed beyond the description. The realistic priority for defenders is moderate: WordPress sites with Kirki installed and exposed to the internet face a low-friction, unauthenticated attack surface for data tampering but not credential theft or full compromise from this vector alone.

An unauthenticated attacker sends a crafted HTTP POST or GET request to a WordPress site running Kirki <= 6.0.11, supplying a manipulated object identifier (such as another user's customizer setting ID or option reference) in the request parameters. Because Kirki does not verify that the requestor owns or has rights to the referenced object, the server processes the request and modifies or disrupts the target data. No authentication, user interaction, or special tooling is required - a basic HTTP client or automated scanner is sufficient.