CVE-2026-103065: Themeum Kirki Auth Bypass Vulnerability

CVE-2026-103065 Overview

CVE-2026-103065 affects the Themeum Kirki plugin for WordPress, a customizer framework used by thousands of themes. The vulnerability stems from improper validation of specified quantity in input [CWE-1284], which allows attackers to access functionality not properly constrained by access control lists (ACLs). Patchstack classifies this issue as an arbitrary code execution vulnerability affecting Kirki versions up to and including 6.3.1. Unauthenticated attackers can exploit the flaw over the network without user interaction.

Critical Impact

Remote attackers can reach privileged functionality in the Kirki plugin without authentication, leading to arbitrary code execution on affected WordPress installations.

Affected Products

• Themeum Kirki plugin for WordPress
• All versions from n/a through 6.3.1
• WordPress sites using themes that bundle the Kirki customizer framework

Discovery Timeline

• 2026-10-03 - CVE-2026-103065 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103065

Vulnerability Analysis

The Kirki plugin exposes functionality that is reachable without the authorization controls necessary to protect it. According to the Patchstack advisory, this gap leads to arbitrary code execution. An unauthenticated remote attacker can invoke the affected code path to influence plugin behavior beyond the intended ACL boundaries. The confidentiality impact is high while integrity impact is limited, reflecting an attacker's ability to read sensitive data and manipulate specific plugin operations. Because Kirki is embedded by many commercial and free WordPress themes, the exposure extends well beyond direct plugin installations.

Root Cause

The root cause is improper validation of a specified quantity in input combined with missing authorization checks on the exposed endpoint. The plugin does not sufficiently validate input length, count, or range before routing requests to privileged handlers. Access control checks that should restrict the handler to administrative users are missing or incomplete, which lets lower-privilege or unauthenticated callers reach code paths intended for site administrators.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to an exposed Kirki endpoint on a WordPress site running version 6.3.1 or earlier. By manipulating input parameters that bypass validation, the attacker reaches plugin functionality that eventually enables arbitrary code execution within the WordPress process context. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-103065

Indicators of Compromise

• Unexpected PHP files written under wp-content/, wp-content/uploads/, or theme directories after HTTP requests targeting Kirki endpoints
• Outbound connections from the webserver to unknown hosts following requests to Kirki-related URLs or AJAX actions
• New or modified administrator accounts in wp_users created without a corresponding audit trail
• Unusual POST requests with large or malformed parameter values directed at Kirki plugin paths

Detection Strategies

• Inventory all WordPress sites and themes for the presence of the Kirki plugin at version 6.3.1 or earlier
• Review web server access logs for unauthenticated POST requests referencing kirki in the URL path or query string
• Correlate webserver process execution events with child process spawns such as sh, bash, or curl originating from PHP-FPM or Apache workers
• Monitor file integrity for the WordPress document root, flagging new executable scripts

Monitoring Recommendations

• Enable WordPress audit logging for plugin configuration changes, option updates, and user role modifications
• Forward webserver, PHP, and WordPress logs to a centralized analytics platform for correlation
• Alert on anomalous outbound traffic volumes from webservers hosting WordPress
• Track EPSS trending for CVE-2026-103065 to prioritize response as exploit likelihood changes

How to Mitigate CVE-2026-103065

Immediate Actions Required

• Identify every WordPress site using the Kirki plugin, including themes that bundle Kirki internally
• Upgrade Kirki to a version later than 6.3.1 once the vendor publishes a fix
• Restrict administrative access to WordPress to known IP ranges while patching is in progress
• Rotate WordPress administrator credentials and API keys if exploitation is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for current patch guidance. All Kirki versions up to and including 6.3.1 are affected. Site operators should update to the first vendor-released version that explicitly addresses CVE-2026-103065 and validate that any theme-bundled copy of Kirki is also updated.

Workarounds

• Disable the Kirki plugin until a patched version can be installed, where feasible
• Deploy a web application firewall rule that blocks unauthenticated requests to Kirki endpoints
• Enforce authentication at the webserver layer for wp-admin and administrative AJAX routes
• Remove or disable themes that bundle vulnerable Kirki code if upstream updates are unavailable

# Example WAF rule concept to block unauthenticated access to Kirki endpoints
SecRule REQUEST_URI "@contains kirki" \
  "id:1030650,phase:1,deny,status:403,\
   msg:'Block unauthenticated Kirki access (CVE-2026-103065)',\
   chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"