CVE-2026-77754: Kirki WordPress Plugin Information Disclosure

CVE-2026-77754 Overview

The Kirki WordPress plugin before version 6.0.14 contains a missing capability check on one of its public AJAX endpoints. The flaw allows unauthenticated attackers to retrieve sensitive information from affected sites over the network. Exposed data includes email addresses of registered users and comment authors, non-public page content, and plugin settings. The issue is classified as an information exposure weakness [CWE-200].

Critical Impact
Unauthenticated remote attackers can enumerate user email addresses and read non-public content and settings from any WordPress site running a vulnerable Kirki plugin version.

Affected Products

Kirki WordPress plugin versions prior to 6.0.14
WordPress sites using themes that bundle Kirki as a customizer framework
Any deployment exposing the affected public AJAX action

Discovery Timeline

2026-08-26 - CVE-2026-77754 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77754

Vulnerability Analysis

Kirki registers public AJAX actions in WordPress that are reachable through wp-admin/admin-ajax.php without authentication. According to the WPScan Vulnerability Report, one of these endpoints omits the required capability check before returning data. As a result, the endpoint honors requests from anonymous callers and returns objects that should be restricted to privileged users.

The returned data includes email addresses of registered users and comment authors, along with the content of pages that are not published publicly and configuration settings managed through the customizer. Email enumeration supports downstream phishing and credential-stuffing campaigns. Access to non-public content and settings can reveal draft business information, internal URLs, and integration keys stored in theme options.

Root Cause

The root cause is broken access control on a public AJAX action. The handler processes requests but does not call current_user_can() or an equivalent capability check before returning privileged fields. WordPress treats any wp_ajax_nopriv_* action as intentionally public, so the plugin must enforce authorization inside the callback. Kirki did not, causing the endpoint to leak data to any network caller.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP POST request to admin-ajax.php with the vulnerable Kirki action parameter and parses the JSON response for user emails, page bodies, and settings. No user interaction, credentials, or privileges are required. Refer to the WPScan advisory for the specific action name and parameters.

Detection Methods for CVE-2026-77754

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing Kirki-specific action parameters
Bursts of anonymous AJAX requests from a single IP followed by outbound phishing targeting site users
HTTP responses from admin-ajax.php containing user email addresses returned to unauthenticated sessions

Detection Strategies

Inspect web server access logs for repeated anonymous requests to admin-ajax.php with Kirki action names, especially from non-browser user agents
Correlate response sizes on admin-ajax.php where unauthenticated calls return payloads significantly larger than expected for public endpoints
Run the Kirki plugin version inventory across managed WordPress hosts and flag any instance below 6.0.14

Monitoring Recommendations

Enable WordPress audit logging for AJAX actions and forward events to a centralized SIEM for retention and correlation
Alert on unauthenticated AJAX responses containing email-like patterns to catch active enumeration
Track new user-agent and IP pairs generating high volumes of admin-ajax.php traffic against sites running Kirki

How to Mitigate CVE-2026-77754

Immediate Actions Required

Upgrade the Kirki plugin to version 6.0.14 or later on all WordPress sites
Audit registered users and comment author accounts for exposed email addresses and rotate any secrets stored in customizer settings
Review web server logs for prior unauthenticated calls to Kirki AJAX actions and treat matching IPs as suspicious

Patch Information

The vendor addressed the issue in Kirki 6.0.14 by adding a capability check to the affected public AJAX action. Site owners should update through the WordPress plugin manager or by deploying the patched release from the plugin repository. Themes that bundle Kirki must ship a theme update containing the fixed version.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) for the specific vulnerable Kirki action until patching completes
Temporarily deactivate the Kirki plugin on sites where an immediate upgrade is not possible
Block anonymous requests to admin-ajax.php that reference Kirki action parameters using reverse-proxy rules

bash

# Example WAF rule (ModSecurity) to block the vulnerable action pre-patch
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1027754,msg:'Block Kirki AJAX pre-patch'"
  SecRule ARGS:action "@rx ^kirki_" "t:lowercase"