CVE-2026-84220 Overview
CVE-2026-84220 affects the Kirki WordPress plugin in versions prior to 6.3.2. The plugin fails to prevent shortcodes embedded in comments from being executed during rendering. It also displays comments regardless of moderation status. Unauthenticated visitors can execute shortcodes registered on the site and read private custom fields of the page being viewed. The vulnerability is classified under [CWE-74] for improper neutralization of special elements in output.
Critical Impact
Unauthenticated attackers can post comments containing shortcodes that execute on rendering, enabling disclosure of private custom field data stored in WordPress.
Affected Products
- Kirki WordPress plugin versions before 6.3.2
- WordPress sites running Kirki with shortcode-enabled custom fields
- WordPress deployments allowing unauthenticated or unmoderated comments
Discovery Timeline
- 2026-10-09 - CVE-2026-84220 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2026-84220
Vulnerability Analysis
The Kirki plugin processes comment content through WordPress shortcode handlers without filtering shortcodes supplied by untrusted sources. When the plugin renders comments, it invokes do_shortcode() on the comment body. This causes any shortcode syntax in the comment to be interpreted and executed by the server.
The plugin also renders comments without checking their moderation state. Comments awaiting approval are displayed to visitors alongside approved content. This removes the review gate administrators rely on to prevent abuse.
Together, these defects allow an unauthenticated visitor to submit a comment containing a shortcode and have it executed immediately when the page is loaded. Shortcodes such as those exposing custom field values can return sensitive data stored on the page.
Root Cause
The root cause is improper neutralization of shortcode syntax in user-supplied comment content, combined with bypass of comment moderation controls. The plugin treats comment input as trusted template data rather than as untrusted user input requiring sanitization.
Attack Vector
An attacker submits a comment to any page or post that renders through the vulnerable Kirki workflow. The comment body contains WordPress shortcode syntax referencing shortcodes registered on the target site. When any visitor loads the page, the plugin executes the shortcode server-side. Output from shortcodes that read private custom fields is returned in the rendered HTML. The attack requires no authentication and no user interaction beyond page load.
See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-84220
Indicators of Compromise
- Comments containing WordPress shortcode syntax such as [shortcode_name] from unauthenticated or anonymous submitters
- Unusual comment entries referencing custom field shortcodes or meta-exposing shortcodes
- Comments visible on public pages that do not appear in the WordPress moderation queue
Detection Strategies
- Review the wp_comments table for entries whose comment_content includes bracket-enclosed shortcode tokens
- Audit web server access logs for POST requests to wp-comments-post.php followed by GET requests to the same post from varied source addresses
- Correlate comment submission timestamps with spikes in response size for the associated post URLs, which can indicate shortcode output leakage
Monitoring Recommendations
- Enable logging on comment submission endpoints and alert on comment bodies containing [ and ] character pairs
- Monitor for new comments appearing on the site that bypass the pending-moderation state
- Track access to pages containing custom fields that are referenced by registered shortcodes
How to Mitigate CVE-2026-84220
Immediate Actions Required
- Update the Kirki WordPress plugin to version 6.3.2 or later
- Audit existing comments for shortcode syntax and delete suspicious entries
- Review custom fields accessible through registered shortcodes and restrict exposure of sensitive data
Patch Information
The vendor addressed the issue in Kirki version 6.3.2. The fix prevents shortcode execution in comment content and restores moderation-state enforcement before rendering. Site administrators should upgrade through the WordPress plugin manager or by replacing plugin files with the patched release.
Workarounds
- Disable comments on posts and pages that render through the Kirki plugin until patching is complete
- Require manual moderation for all comments and verify the moderation workflow is enforced at the theme or plugin layer
- Remove or restrict shortcodes that expose private custom fields to reduce the sensitivity of any data leaked by exploitation
# Update Kirki plugin via WP-CLI
wp plugin update kirki --version=6.3.2
# Temporarily disable comments site-wide while patching
wp option update default_comment_status closed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
