Kirki
Monthly
Broken object-level access control in the Kirki plugin for WordPress before 6.4.1 lets any user who holds Kirki edit access - granted to the Editor role by default - rewrite the title, slug and post_status of arbitrary non-trashed posts, including custom post types and WooCommerce products they do not own, exposing private or draft content or silently unpublishing live content. The PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate and delete handlers in PageController.php apply only a coarse role-to-access middleware check and never perform a per-object WordPress capability check. Exploitation requires an authenticated account with Kirki edit access (CVSS vector PR:L); no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released 6.4.1, so remediation is prioritized for this week rather than treated as an emergency.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.
Authenticated low-privilege users can inject script-related HTML into WordPress sites running Themeum Kirki 6.4.0 or earlier, producing a basic XSS condition. The authoritative assessment rates it medium severity with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N and notes that a second user, typically an administrator, must view the affected page for a stored payload to execute; the specific injection point is not described in the available sources. No public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
Unauthenticated visitors can execute shortcodes registered on a WordPress site running Kirki before 6.3.2 by submitting a comment, and can read private custom fields of the page being viewed, because the plugin renders shortcodes held in comment text and displays comments regardless of their moderation status. The vulnerability carries a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with the high attack complexity reflecting that real-world impact depends on which shortcodes a site has registered and whether comments are enabled; publicly available exploit code exists, though there is no CISA KEV listing confirming active exploitation at time of analysis. A vendor patch is available in Kirki 6.3.2.
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to be uploaded site-wide without sanitization; an authenticated user with Author-level access or higher can upload an SVG carrying embedded JavaScript that is then served from the site's own origin. When a victim - ideally an administrator - opens or views that file, the script runs in their session, giving the attacker same-origin script execution with high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), and publicly available exploit code exists. This is a genuine but conditionally-gated stored-XSS priority rather than a mass-exploitation emergency: it requires an authenticated Author-level account and a victim interacting with the uploaded file, and it is fully mitigated by upgrading to 6.3.1.
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the full rendered page content of posts that are in private, draft, pending, or trashed states. The plugin renders and returns post content without first verifying whether the requesting party holds read permissions for that post, effectively bypassing WordPress's built-in visibility controls. A publicly available proof-of-concept exists via WPScan, though EPSS probability remains low at 0.14%, and the flaw has not been added to CISA KEV as of this analysis.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails, non-public page content, and site settings to unauthenticated remote attackers via missing capability checks on public AJAX action endpoints. Every WordPress site running any Kirki version prior to 6.0.14 is affected regardless of configuration. A publicly available proof-of-concept exists per WPScan reporting; exploitation probability is currently low (EPSS 0.18%, 7th percentile) and no active exploitation is confirmed in CISA KEV, though the data harvested enables downstream phishing and credential-stuffing campaigns.
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. No confirmed active exploitation appears in CISA KEV at time of analysis, though SSVC rates technical impact as total.
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. A publicly available proof-of-concept exploit exists per WPScan, and a vendor patch has been released.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Broken object-level access control in the Kirki plugin for WordPress before 6.4.1 lets any user who holds Kirki edit access - granted to the Editor role by default - rewrite the title, slug and post_status of arbitrary non-trashed posts, including custom post types and WooCommerce products they do not own, exposing private or draft content or silently unpublishing live content. The PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate and delete handlers in PageController.php apply only a coarse role-to-access middleware check and never perform a per-object WordPress capability check. Exploitation requires an authenticated account with Kirki edit access (CVSS vector PR:L); no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released 6.4.1, so remediation is prioritized for this week rather than treated as an emergency.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.
Authenticated low-privilege users can inject script-related HTML into WordPress sites running Themeum Kirki 6.4.0 or earlier, producing a basic XSS condition. The authoritative assessment rates it medium severity with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N and notes that a second user, typically an administrator, must view the affected page for a stored payload to execute; the specific injection point is not described in the available sources. No public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
Unauthenticated visitors can execute shortcodes registered on a WordPress site running Kirki before 6.3.2 by submitting a comment, and can read private custom fields of the page being viewed, because the plugin renders shortcodes held in comment text and displays comments regardless of their moderation status. The vulnerability carries a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with the high attack complexity reflecting that real-world impact depends on which shortcodes a site has registered and whether comments are enabled; publicly available exploit code exists, though there is no CISA KEV listing confirming active exploitation at time of analysis. A vendor patch is available in Kirki 6.3.2.
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to be uploaded site-wide without sanitization; an authenticated user with Author-level access or higher can upload an SVG carrying embedded JavaScript that is then served from the site's own origin. When a victim - ideally an administrator - opens or views that file, the script runs in their session, giving the attacker same-origin script execution with high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), and publicly available exploit code exists. This is a genuine but conditionally-gated stored-XSS priority rather than a mass-exploitation emergency: it requires an authenticated Author-level account and a victim interacting with the uploaded file, and it is fully mitigated by upgrading to 6.3.1.
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the full rendered page content of posts that are in private, draft, pending, or trashed states. The plugin renders and returns post content without first verifying whether the requesting party holds read permissions for that post, effectively bypassing WordPress's built-in visibility controls. A publicly available proof-of-concept exists via WPScan, though EPSS probability remains low at 0.14%, and the flaw has not been added to CISA KEV as of this analysis.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails, non-public page content, and site settings to unauthenticated remote attackers via missing capability checks on public AJAX action endpoints. Every WordPress site running any Kirki version prior to 6.0.14 is affected regardless of configuration. A publicly available proof-of-concept exists per WPScan reporting; exploitation probability is currently low (EPSS 0.18%, 7th percentile) and no active exploitation is confirmed in CISA KEV, though the data harvested enables downstream phishing and credential-stuffing campaigns.
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. No confirmed active exploitation appears in CISA KEV at time of analysis, though SSVC rates technical impact as total.
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to execute arbitrary registered WordPress shortcodes via unprotected front-end form submission REST routes. On a default WordPress install, exploitation leads to disclosure of the site administrator's email address and abuse of the victim domain as a mail relay to arbitrary recipients. A publicly available proof-of-concept exploit exists per WPScan, and a vendor patch has been released.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.