Kirki EUVD-2026-43373

Exploitation requires only that a vulnerable Kirki version (≤ 6.0.13) is installed and its affected endpoint is network-reachable - per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client configuration are needed against a default install. The concrete precondition is presence of the Kirki plugin/framework (directly or theme-bundled) exposing the mis-authorized action. Limiting factors: impact is confined to confidentiality (information disclosure only - no write/integrity or availability effect), the exact sensitive data returned depends on what the vulnerable endpoint exposes, and sites not running Kirki or already updated past 6.0.13 are unaffected; the precise vulnerable action/parameter is described only generically in the input and should be confirmed against the Patchstack advisory.

The signals are moderately consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network reachability with no authentication or user interaction, which supports elevated concern, but the impact is scoped to confidentiality only (C:H/I:N/A:N) - an information-disclosure issue, not code execution or defacement. There is no CISA KEV listing and no known public POC, so this is not confirmed actively exploited; EPSS was not provided in the input. No SSVC decision was supplied. Net assessment: a legitimate patch-worthy issue for exposed WordPress sites given the unauthenticated network vector, but its ceiling is data leakage rather than full compromise, so it ranks below RCE/auth-bypass-to-admin classes of the same 7.5 score. Note the description's phrase 'Incorrectly Configured Access Control Security Levels' is somewhat generic - the exact leaked data and endpoint should be confirmed against the Patchstack advisory.

An attacker enumerates a target WordPress site, identifies that a vulnerable Kirki version (≤6.0.13) is present via theme fingerprinting, and sends a crafted unauthenticated HTTP request to the affected Kirki endpoint. Because the authorization check is missing, the request is served and returns configuration or other sensitive data the attacker should not be able to read. No public POC is currently identified, but the low-complexity, no-auth vector makes automated scanning feasible if exploit details are published.