Kirki WordPress Plugin EUVD-2026-66286

No special conditions are required - this is remote unauthenticated exploitation against any default WordPress installation running Kirki below 6.0.14. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated complexity, and no user interaction. The vulnerable AJAX endpoints are registered as publicly accessible handlers by the plugin itself. Exploitation is constrained to information disclosure: no code execution, no integrity or availability impact. The practical data yield scales with site content - sites with more registered users expose more email addresses, and sites with sensitive non-public draft pages or settings expose more content. No non-default configuration is required to be vulnerable, and no configuration hardens the exposure short of deactivation or patching.

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the attack surface: unauthenticated, network-reachable, zero-complexity exploitation bounded to a limited confidentiality impact with no integrity or availability dimension. EPSS at 0.18% (7th percentile) indicates low near-term exploitation probability despite the publicly available proof-of-concept - these signals are consistent rather than conflicting, suggesting targeted rather than automated mass exploitation at this stage. The vulnerability is not listed in CISA KEV, reinforcing the low-activity picture. Real-world risk is weighted by site profile: a site with many registered users or sensitive draft content faces meaningful data-exposure and user-enumeration risk, while a simple brochure site with no registered users beyond the admin faces minimal practical exposure. The low EPSS score should not breed complacency for high-user-count or content-sensitive deployments, since harvested email addresses directly enable phishing and credential-stuffing attacks against site users. No conflicting signals between CVSS and description - both indicate network, unauthenticated, information-disclosure only.

A publicly available proof-of-concept exists per WPScan. An attacker passively fingerprints a target WordPress site as running Kirki (via plugin enumeration or theme analysis), then sends a crafted unauthenticated HTTP POST to wp-admin/admin-ajax.php targeting the vulnerable public AJAX action, receiving in the response a list of registered user and comment author email addresses along with non-public page content and site settings - requiring no credentials, no user interaction, and no special network position.