CVE-2026-102291 Overview
CVE-2026-102291 affects the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress through version 6.3.1. The plugin substitutes a user's display_name into composed page markup without filtering, then passes the result to do_shortcode() inside TheFrontend::replace_content(). Because WordPress exposes display_name for editing on every user's own profile, authenticated attackers with Subscriber-level access can inject arbitrary shortcodes. When the affected page renders a user collection such as a team or member directory, the attacker-controlled shortcode executes for every visitor, including unauthenticated users. The flaw is classified under [CWE-74] Improper Neutralization of Special Elements in Output.
Critical Impact
Low-privileged accounts can store shortcode payloads in a profile field that execute in every visitor's request against pages binding display_name as dynamic content.
Affected Products
- Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
- All versions up to and including 6.3.1
- Sites publishing a page with a Kirki element bound to the display_name user field
Discovery Timeline
- 2026-10-10 - CVE-2026-102291 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-102291
Vulnerability Analysis
The vulnerability resides in Kirki's frontend rendering pipeline. TheFrontend::replace_content() composes final page markup by substituting dynamic tokens with user profile fields, then hands the entire string to WordPress do_shortcode(). The substitution writes raw display_name content into the markup without sanitizing shortcode delimiters. Any text an attacker places in their profile becomes shortcode input processed by the server.
Shortcode execution occurs in the HTTP request context of whichever user views the page. On a members directory or team listing bound to display_name, that context includes unauthenticated visitors. Depending on which shortcodes the site has registered, this can expose private data, trigger server-side actions, or render attacker-controlled HTML inside trusted pages.
Root Cause
The root cause is unfiltered interpolation of user-controlled data into a string later evaluated by do_shortcode(). WordPress treats display_name as a free-form profile attribute editable by every registered user. Kirki stores and renders it as trusted markup. The affected code paths include includes/Frontend/Preview/Utils.php (lines 308, 334, 408), includes/Frontend/TheFrontend.php line 144, includes/HelperFunctions.php line 1117, and includes/Manager/PluginShortcode.php line 40.
Attack Vector
An attacker registers or logs in as a Subscriber, then edits their profile and sets display_name to a payload containing WordPress shortcode syntax. When any visitor loads a page with a Kirki element bound to display_name, the server executes the injected shortcode. The attack requires network access, low privileges, and no user interaction. See the Wordfence vulnerability analysis and the Kirki source references on WordPress.org for the vulnerable code paths.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-102291
Indicators of Compromise
- User profiles whose display_name field contains shortcode delimiters ([ and ]) or references to known shortcodes.
- Unexpected shortcode output rendered within member or team directory pages built with Kirki.
- Recent Subscriber-level registrations followed by profile updates that modify display_name.
Detection Strategies
- Query the wp_users table for display_name values matching regular expressions such as \[[a-z0-9_\- ]+(\s|\]).
- Audit WordPress profile update events for Subscriber accounts modifying display_name within short windows after registration.
- Review page templates for Kirki dynamic bindings referencing the display_name user field.
Monitoring Recommendations
- Enable WordPress action logging on profile_update and user_register hooks and forward events to a centralized log store.
- Monitor HTTP responses from member directory pages for unexpected markup, redirects, or outbound requests.
- Track plugin version inventory and alert on any WordPress site still running Kirki 6.3.1 or earlier.
How to Mitigate CVE-2026-102291
Immediate Actions Required
- Update the Kirki plugin to version 6.3.2 or later on all WordPress sites.
- Audit existing user accounts and sanitize any display_name values containing shortcode syntax.
- Restrict new user registration or require administrator approval until the patch is applied.
Patch Information
The vendor addressed the issue in Kirki 6.3.2. The fix is documented in the WordPress plugin changeset from 6.3.1 to 6.3.2. Site operators should upgrade through the WordPress dashboard or by replacing plugin files on disk.
Workarounds
- Remove or unbind any Kirki element that renders display_name as dynamic content until the plugin is patched.
- Disable open user registration under Settings → General, or limit new registrations to the Subscriber role with no profile edit permissions.
- Apply a filter on pre_user_display_name to strip [ and ] characters from submitted values.
# Configuration example
wp plugin update kirki --version=6.3.2
wp user list --fields=ID,user_login,display_name --format=csv \
| grep -E '\[[a-z0-9_\- ]+'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
