CVE-2026-102291 themeum CVE debrief

Who should care

Defenders responsible for WordPress installations with the Kirki plugin should assess exposure and prioritize verification of the display name input field. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for suspicious shortcode activity. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Authenticated arbitrary shortcode execution in Kirki plugin allows attackers to inject malicious content and potentially elevate privileges.

• Execution of arbitrary shortcodes by authenticated attackers
• Potential for malicious content injection
• Elevation of privileges through shortcode execution
• Compromise of affected WordPress installations

Technical summary

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authenticated arbitrary shortcode execution due to unfiltered user input in the display name field. This allows attackers with Subscriber-level access to execute arbitrary shortcodes, potentially leading to malicious content injection and elevation of privileges. The vulnerability exists in all versions up to, and including, 6.3.1 of the plugin. The exploitation of this vulnerability requires a published page with a Kirki element whose dynamic content is bound to the display_name user field.

Defensive priority

Defenders should prioritize verifying the display name input field for shortcode execution and restrict access to the Kirki plugin's settings.

Recommended defensive actions

• Verify the display name input field for shortcode execution
• Restrict access to the Kirki plugin's settings
• Monitor for suspicious shortcode activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected plugin version and exploitation requirements. The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authenticated arbitrary shortcode execution due to unfiltered user input in the display name field. Defenders should verify the display name input field for shortcode execution and restrict access to the Kirki plugin's settings. Evidence limits are based on CVE and source-item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.