CVE-2026-84220
Received Received - Intake

Kirki Plugin Shortcode Execution via Comment Rendering

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-84220
EUVD
EUVD-2026-95576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Kirki 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki WordPress plugin before version 6.3.2 has a vulnerability where it executes shortcodes embedded in comments, even if those comments are not approved or moderated. This allows unauthenticated users to run any shortcode registered on the site and access private custom fields of the page being viewed.

Detection Guidance

Check the installed version of the Kirki WordPress plugin. If it is below 6.3.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your WordPress site without authentication. They could access sensitive data like private custom fields, manipulate site content, or perform actions as if they were a legitimate user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Exposure of private custom fields may include protected health information or user data, resulting in legal and regulatory penalties.

Mitigation Strategies

Update the Kirki plugin to version 6.3.2 or later immediately. Disable comment functionality temporarily if updates are not possible, or restrict comment moderation to prevent unauthenticated shortcode execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart