Themeum Kirki: Improper access control due to input validation flaw
Summary
Kirki is a WordPress plugin used as a Customizer toolkit by theme developers, and it can also be bundled inside themes where it is hidden from normal plugin updates. The CVE description says that an attacker can reach functionality that is not properly restricted by access control lists, because a specified quantity in input is not validated. The CVSS vector rates the flaw 8.2 (high): it is reachable over the network with low complexity, requires no privileges and no user interaction, and affects confidentiality and integrity. Patchstack's title refers to arbitrary code execution, but the CVE text does not confirm this, so the actual impact is unverified.
Affected
- Kirki from n/a through 6.3.1 (CVE record)
- Patchstack lists vulnerable versions as <= 6.3.1
- Themes that embed Kirki may carry a vulnerable version without a visible plugin update
Fixed in
- Vendor and CNA guidance: update to 6.3.2 or later (Patchstack, CVE record)
- Not independently confirmed against the Themeum advisory or the WordPress.org changelog
- Latest available release is recommended; other 2026 Kirki CVEs are fixed in 6.4.1
Workaround
- Unknown. No vendor-documented workaround was found.
- If an update is not possible, deactivate Kirki where no theme or page depends on it.
Exploitation
- No evidence of exploitation in the wild found in the sources.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
- Aggregators state the CVE is not in the CISA KEV catalog; no public exploit code confirmed.
- Patchstack rates it high priority and expects exploitation, so the risk is elevated.
Our recommendation
- Inventory all WordPress sites, including multisite and theme-bundled Kirki, and record the exact version.
- Update Kirki to the latest release (6.4.1 or later) as soon as possible.
- If an update is not possible, deactivate Kirki where it is not needed.
- Review administrator accounts and recent logs for unusual activity.
- Verify the fixed version against the Patchstack or Themeum advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Kirki plugin <= 6.3.1 Arbitrary Code Execution vulnerability patchstack.com
- Rapid7 via Vulners: CVE-2026-103065 vulners.com
- VulDB: CVE-2026-103065 vuldb.com
- Strix: CVE-2026-103065 www.strix.ai
- OffSeq Radar: CVE-2026-103065 radar.offseq.com
- TheHackerWire: CVE-2026-103065 www.thehackerwire.com
- WordPress.org: Kirki plugin wordpress.org
- Themeum Kirki documentation: integration docs.themeum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:03.
Original description (NVD)
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.