CVE-2026-102291

Executive Summary

CVE-2026-102291 is an arbitrary shortcode execution vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin, affecting all versions up to and including 6.3.1. The flaw allows authenticated attackers with Subscriber-level access or above to inject arbitrary WordPress shortcodes via their account display_name, which are then executed when a page using a Kirki element bound to the display_name field is rendered. This can lead to stored cross-site scripting (XSS), information disclosure, and—on user directory pages—execution in the browser of every visitor, including unauthenticated users, though the CVSS score of 5.4 reflects moderate severity due to limited confidentiality and integrity impact.

Technical Analysis

The vulnerability resides in the TheFrontend::replace_content() method, which is responsible for composing dynamic page markup. The root cause is that the plugin takes the WordPress user display_name field and substitutes it into the composed page markup without applying any output sanitization or escaping. The entire assembled markup—now containing the user-controlled display name—is subsequently passed through the WordPress core do_shortcode() function.

Because do_shortcode() interprets any registered shortcode syntax (e.g., [shortcode]) present in the input, an attacker can set their display_name to a value containing a shortcode. Any shortcode available in the WordPress environment (from core, themes, or other plugins) can be executed. This includes potentially dangerous shortcodes that reveal private data, embed external content, or trigger state-changing actions.

The display_name field is writable by any authenticated user through the core WordPress profile form, meaning that a low-privileged account (Subscriber) is sufficient to plant the payload. The vulnerability requires a published page that contains a Kirki element whose dynamic content is explicitly bound to the display_name user field. When such a page is viewed, the plugin fetches the attacker's display name and injects it into the page markup, causing the shortcode to execute.

The attack surface is amplified on “users collection” pages (team or member directories), where the shortcode output is rendered for every visitor. In this scenario, an unauthenticated visitor would trigger the embedded shortcode simply by viewing the page. The vulnerability does not require any user interaction beyond the initial account creation and page configuration, and the network attack vector is exploited remotely. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) confirms that the attacker must be authenticated (PR:L) but no user action is needed on the victim’s part (UI:N), with limited confidentiality and integrity impact and no availability impact.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-102291. The following scenario is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / Target Identification: The attacker identifies a WordPress site that runs the Kirki – Freeform Page Builder plugin version 6.3.1 or earlier. They also look for a published page containing a Kirki element whose dynamic content is bound to the display_name user field—commonly found on team, author, or member-directory pages. The presence of such a page is a prerequisite for exploitation.

2. Account Registration / Access: The attacker registers or compromises a subscriber-level account. This low privilege is sufficient because the display_name field is editable by any authenticated user via the core WordPress profile form.

3. Payload Injection: The attacker changes their display_name to a string that contains a WordPress shortcode payload (e.g., [some_shortcode]). The exact shortcode used depends on which shortcodes are registered on the target site. Common targets include shortcodes that output sensitive data, embed JavaScript, or perform actions. The attacker does not need to inject anything beyond the shortcode syntax.

4. Triggering Execution: The attacker or any visitor navigates to the page containing the Kirki element bound to the user’s display_name. When the page is generated, TheFrontend::replace_content() substitutes the attacker’s display_name into the markup without filtering and passes the entire string through do_shortcode(). The shortcode is executed. If the page is a users-collection page, the shortcode executes for every visitor, including unauthenticated ones.

5. Post-Exploitation Impact: Successful exploitation results in the execution of arbitrary shortcodes. Depending on the shortcodes available, the attacker may achieve stored cross-site scripting (if the shortcode generates JavaScript or HTML), disclosure of sensitive information, manipulation of page content, or in some cases privilege escalation or further site compromise. The CVSS score of 5.4 indicates low confidentiality and integrity impact, but the real-world effect hinges on what shortcodes are present on the target site.

Impact Assessment

The vulnerability allows authenticated attackers with minimal privileges (Subscriber) to execute arbitrary shortcodes on pages that use Kirki elements bound to the display_name field. The CVSS 3.1 base score is 5.4 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. This indicates:

• Confidentiality (C:L): The attacker may be able to read limited sensitive data via shortcodes that expose user information, private posts, or configuration details.
• Integrity (I:L): The attacker can modify the rendered content of pages, potentially injecting malicious scripts or unwanted material, but the scope is limited to the shortcode execution context.
• Availability (A:N): No direct denial-of-service impact is expected from shortcode execution alone.

The blast radius extends to all visitors of affected pages if a users-collection page is used, because the payload executes for every page load. This is a stored, persistent vulnerability that could be leveraged for widespread client-side attacks (e.g., XSS via shortcodes that output unsanitized HTML). However, the requirement of a specific page configuration (Kirki element with display_name binding) reduces the number of vulnerable targets somewhat. There is no evidence of active exploitation in the wild, and CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

title: WordPress Kirki Plugin Display Name Shortcode Execution Attempt
id: 6a3f8c2d-4e1b-4f7a-9b2e-1d5c3a8f7e6b
status: experimental
description: Detects access to a WordPress users collection page that may trigger shortcode execution from the display_name field.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102291
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-102291
logsource:
  category: web
  product: apache
  service: access_combined
detection:
  selection_page:
    cs-uri-query|contains:
      - 'kirki'
      - 'display_name'
      - 'users'
      - 'team'
      - 'member'
  selection_status:
    sc-status: 200
  condition: selection_page and selection_status
falsepositives:
  - Legitimate user browsing of team or member pages
level: medium

YARA Rule

rule CVE_2026_102291_Kirki_Shortcode_Execution
{
    meta:
        description = "Detects Kirki plugin files that may be vulnerable to arbitrary shortcode execution"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102291"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "TheFrontend" ascii wide
        $s2 = "replace_content" ascii wide
        $s3 = "do_shortcode" ascii wide
        $s4 = "display_name" ascii wide

    condition:
        all of ($s1, $s2, $s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102291 WordPress Kirki Plugin Shortcode Execution Attempt"; flow:to_server,established; http.uri; content:"/wp-admin/profile.php"; http.method; content:"POST"; http.request_body; content:"display_name"; pcre:"/\[[a-zA-Z0-9_\-]+\]/"; classtype:web-application-attack; sid:2026102291; rev:1;)

Elastic Detection

network where
  process.name == "httpd" and
  http.request.method == "POST" and
  http.request.uri == "/wp-admin/profile.php" and
  http.request.body contains "display_name" and
  http.request.body regex "\\[[a-zA-Z0-9_\\-]+\\]"

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="/wp-admin/profile.php" method=POST
| rex field=form_data "display_name=(?<display_name>[^&]+)"
| where match(display_name, "\[[a-zA-Z0-9_\-]+\]")
| table _time, src_ip, uri, display_name, status

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100291" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\/wp-admin\/profile.php</field>
    <field name="method">POST</field>
    <field name="body">display_name=.*\[.*\]</field>
    <description>CVE-2026-102291: WordPress Kirki plugin shortcode injection attempt via display_name</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable or remove the Kirki – Freeform Page Builder plugin until a patch is available.
   • Restrict user registration and profile editing to trusted users only (e.g., disable public subscriber registrations, enforce manual approval).
   • If the plugin must remain active, avoid creating or publishing pages that bind Kirki elements to the display_name user field (especially users-collection pages).
   • Apply a virtual patch via a Web Application Firewall (WAF) that blocks requests containing shortcode syntax in the display_name parameter on profile update requests.
   • Monitor user profile changes for display_name values containing shortcode-like patterns (e.g., square brackets with alphanumeric content).

2. Patch/Upgrade Steps:

   • No official patch is available as of the latest intelligence. Monitor the WordPress plugin repository and the vendor’s site for version 6.3.2 or later.
   • When a patched version is released, upgrade immediately. Test in a staging environment before deploying to production.

3. Long-Term Hardening:

   • Enforce role-based restrictions on profile fields, limiting who can modify display_name if the site does not require user-editable display names.
   • Implement a Web Application Firewall (WAF) rule that inspects POST bodies for shortcode patterns and blocks or sanitizes them.
   • Regularly audit WordPress plugins for unpatched vulnerabilities and remove unused or abandoned plugins.
   • Apply the principle of least privilege: ensure subscribers cannot access functionality beyond what is necessary.
   • Consider using a security plugin that adds output encoding and input validation layers to prevent similar injection flaws.

References

• NVD – CVE-2026-102291: https://nvd.nist.gov/vuln/detail/CVE-2026-102291
• WordPress Plugin Repository – Kirki: https://wordpress.org/plugins/kirki/
• CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: Not applicable (CVE-2026-102291 is not listed as of this report).