EUVD-2026-57174
GHSA-p469-wjxr-57rr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
REST endpoint is network-accessible with no authentication required; impacts are bounded to admin email disclosure (C:L) and mail relay abuse (I:L), with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
AnalysisAI
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for the core exploitation path - the attack is fully unauthenticated and targets the default REST API surface of any WordPress installation running Kirki before 6.2.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N accurately reflects a network-exploitable, zero-interaction, unauthenticated attack with limited but concrete impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Kirki below 6.2.1 via plugin enumeration or passive discovery. The attacker sends a crafted HTTP POST request to the exposed Kirki REST form submission endpoint, embedding a shortcode payload (for example, a contact-form shortcode with an attacker-controlled recipient address) in the request body. … |
| Remediation | Update the Kirki WordPress plugin to version 6.2.1 or later, which is confirmed as the vendor-released fix per EUVD-2026-57174 and the WPScan advisory at https://wpscan.com/vulnerability/4330c6e0-071e-49d6-b1ec-5c8633171bc4/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
Share
External POC / Exploit Code
Leaving vuln.today