CVE-2026-57680: Kirki IDOR Authentication Bypass Flaw

CVE-2026-57680 Overview

CVE-2026-57680 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Kirki WordPress plugin in versions up to and including 6.0.11. The flaw allows unauthenticated attackers to access or manipulate objects by directly referencing them through user-controlled identifiers. Because authentication is not required, any remote attacker with network access to the WordPress site can attempt exploitation. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and is documented in the Patchstack Vulnerability Report.

Critical Impact
Unauthenticated attackers can bypass authorization checks to access or modify objects belonging to other users or the site itself, resulting in limited integrity and availability impact.

Affected Products

Kirki WordPress plugin versions up to and including 6.0.11
WordPress sites using Kirki as a customizer framework
Themes bundling vulnerable Kirki releases

Discovery Timeline

2026-07-02 - CVE-2026-57680 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57680

Vulnerability Analysis

The Kirki plugin exposes functionality that references internal objects using identifiers supplied directly by the requester. The plugin fails to validate whether the calling user is authorized to act on the referenced object. An unauthenticated attacker can substitute identifiers in a request to reach resources they should not be able to reach. The vulnerability is reachable over the network with low attack complexity and requires no user interaction. Impact is limited to integrity and availability, with no direct confidentiality exposure noted in the advisory.

Root Cause

The root cause is missing authorization enforcement on request handlers that accept object identifiers as input. The plugin trusts client-supplied keys without verifying that the requester owns the referenced resource or possesses the required capability. This maps to CWE-639, authorization bypass through a user-controlled key.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable Kirki endpoint from any network location. The request contains an identifier that references an object outside the attacker's authorization scope. Because no authentication or capability check is performed, the plugin processes the request and performs the requested action. No verified public exploit is currently referenced in the advisory. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-57680

Indicators of Compromise

Unauthenticated HTTP requests to Kirki plugin endpoints containing numeric or string identifiers in query parameters or POST bodies
Unexpected modifications to WordPress customizer settings, options, or Kirki-managed configuration values
Repeated requests iterating through sequential identifier values from a single source address

Detection Strategies

Inspect web server access logs for requests to /wp-admin/admin-ajax.php or /wp-json/ routes referencing Kirki actions without an authenticated session cookie
Alert on high-volume enumeration patterns targeting Kirki endpoints from a single client
Compare current Kirki plugin version against 6.0.11 across all managed WordPress installations

Monitoring Recommendations

Enable WordPress audit logging for option changes and customizer modifications
Forward web application logs to a centralized analytics platform for correlation and retention
Monitor for anomalous changes to site configuration outside normal administrator activity windows

How to Mitigate CVE-2026-57680

Immediate Actions Required

Identify all WordPress installations running Kirki 6.0.11 or earlier and prioritize them for update
Restrict access to WordPress admin and REST API endpoints using a web application firewall or IP allowlisting where feasible
Review recent modifications to customizer settings and Kirki-managed options for signs of tampering

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch guidance. Upgrade Kirki to a version later than 6.0.11 once a fixed release is available from the maintainer. Verify theme dependencies do not pin a vulnerable Kirki version.

Workarounds

Deactivate the Kirki plugin until a fixed release can be installed, if operationally acceptable
Deploy WAF rules to block unauthenticated requests to Kirki AJAX and REST endpoints
Enforce strict capability checks at the reverse proxy layer for administrative WordPress routes

bash

# Example WAF rule concept - block unauthenticated Kirki AJAX actions
# Adapt for your WAF syntax (ModSecurity, Cloudflare, etc.)
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002026,msg:'Block unauthenticated Kirki IDOR attempt'"
  SecRule ARGS:action "@rx ^kirki_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"