CVE-2026-57727: WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability

Q: Which deployments are affected?

Sites using the Themeum Kirki WordPress plugin are affected if they run version 6.0.13 or an earlier affected version. The available data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. It can expose confidential information, while no integrity or availability impact is indicated by the supplied severity vector.

Published Jul 13, 2026

Updated

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.

Affected Software

1 affected component

wordpress/kirki><=6.0.13

Event History

Jul 13, 2026

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Sites using the Themeum Kirki WordPress plugin are affected if they run version 6.0.13 or an earlier affected version. The available data does not identify a fixed version.

What does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. It can expose confidential information, while no integrity or availability impact is indicated by the supplied severity vector.

CVE-2026-57727: WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?