CVE-2026-103065: WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
Published Oct 3, 2026
·Updated
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
Affected Software
1 affected component
Themeum Kirki<=6.3.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kirki pluginto a version that resolves this vulnerability.Fixed in 6.3.2
Event History
Oct 3, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
Themeum Kirki installations from an unspecified earliest version through version 6.3.1 are affected.
2
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates the issue is network-accessible, requires low attack complexity, and needs neither privileges nor user interaction.
3
What impact can successful exploitation have?
The reported impact includes high confidentiality impact and low integrity impact. No availability impact is indicated.