CVE-2026-16747

Executive Summary

CVE-2026-16747 is an unauthenticated shortcode injection vulnerability affecting the Kirki WordPress plugin in versions prior to 6.2.1. The flaw resides in the plugin's front-end form submission REST routes, which lack proper authorization checks and pass attacker-controlled input through WordPress's do_shortcode() execution path, allowing remote, unauthenticated attackers to execute any shortcode registered on the target site. On a default WordPress installation, this results in two primary impacts: disclosure of the site administrator's email address (via shortcodes that leak user data) and an arbitrary-recipient mail relay that abuses the victim domain's mail server. The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network, earning a CVSS base score of 6.5 (Medium severity). The patch confidence is 0/4 across tracked sources, and no public exploit code or Nuclei template exists at the time of writing; exploitation is currently assessed as private or not yet observed in the wild.

Technical Analysis

The Kirki WordPress plugin (developed by Themeum) provides a customizable theme options framework. According to the NVD description, the vulnerability is present in versions before 6.2.1 and is rooted in two distinct but chained weakness classes:

• Broken access control on REST routes: The plugin exposes front-end form submission endpoints via WordPress REST API routes. These routes are not properly authorized, meaning the plugin does not verify that the requesting user has the required capability (e.g., manage_options or even edit_posts) before processing incoming requests. As a result, any unauthenticated HTTP client can submit data to these endpoints.

• Unsanitized shortcode execution: The attacker-controlled input received by these REST routes is passed through the WordPress do_shortcode() mechanism without sufficient sanitization or validation. WordPress shortcodes are user-defined macros — arbitrary PHP callbacks registered via add_shortcode() — that can generate HTML, query the database, send emails, or perform any action the developer programmed. By injecting a shortcode string (e.g., [some_shortcode attribute="value"]), an unauthenticated attacker can trigger the execution of that registered shortcode on the server.

The vulnerability is classified under CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') — which is the canonical weakness for code/command injection where input is not sanitized before being interpreted by another component (in this case, the shortcode parser).

Attack surface: The vulnerable component is the REST route registered by the Kirki plugin for front-end form submissions. The attack surface is the WordPress REST API (/wp-json/... endpoint paths are not enumerated in the NVD description and must not be invented). The attacker sends an HTTP POST request to the vulnerable route with a crafted payload containing shortcode syntax.

Impacts (default install):

• Administrator email disclosure: The default WordPress installation registers shortcodes that render author/user information — for example, a shortcode that outputs the post author's email address. By invoking that shortcode through the vulnerable route, the attacker retrieves the site administrator's email address, which can then be used for targeted phishing, credential-stuffing, or social engineering campaigns against the administrator.
• Arbitrary-recipient mail relay: WordPress and common plugins register shortcodes that can send emails (e.g., contact-form shortcodes, newsletter plugins, or custom wp_mail() wrapped in shortcode callbacks). Because the attacker controls shortcode attributes, they can supply a recipient address of their choosing, causing the victim's WordPress server to send emails from the victim's domain to arbitrary recipients. This enables domain reputation abuse, phishing from a trusted domain, and potential blacklisting of the victim's mail server.

The interaction of these two flaws — missing authorization + shortcode injection — makes this a single-request exploit requiring no authentication (PR:N) and no user interaction (UI:N), with partial impact to confidentiality (C:L — email leak) and integrity (I:L — mail relay / content manipulation), but no impact to availability (A:N).

Exploitation Scenarios

1) Reconnaissance / Target identification: An attacker first identifies WordPress sites running the Kirki plugin. This can be achieved by:

• Scanning for WordPress sites and fingerprinting plugins via the wp-content/plugins/kirki/ directory path.
• Using search dorks such as inurl:/wp-content/plugins/kirki/ on search engines.
• Querying public WordPress plugin databases or using vulnerability scanners that enumerate installed plugins.

The attacker also enumerates the target's registered shortcodes by inspecting the site's source code, reading plugin documentation, or leveraging WordPress's public HTTP endpoints that may leak shortcode names. For a default install, the attacker can rely on well-known core shortcodes (e.g., those that output user information) without enumeration.

2) Flaw class trigger: The attacker crafts an HTTP request targeting the vulnerable front-end form submission REST route exposed by the Kirki plugin. Because the route lacks authorization checks, the request requires no authentication token or nonce. The attacker supplies a parameter that the plugin passes to do_shortcode().

3) Payload / execution method (vulnerability-class level):

• The attacker injects a shortcode string into the parameter. Example concept (pseudocode, not a real payload — must not invent exact syntax): the request includes something like content=[registered_shortcode attribute="value"].
• The plugin invokes WordPress's shortcode parser (do_shortcode()), which recognizes the bracket notation, extracts the shortcode name and attributes, and executes the corresponding registered PHP callback.
• The callback runs with full server context — it can output database content (e.g., admin email), send emails via wp_mail(), or perform other actions depending on which shortcodes the site has registered.

4) Post-exploitation impact:

• Email disclosure: The attacker exfiltrates the administrator's email address from the shortcode output, which can be used for targeted phishing (e.g., fake plugin-update notifications) to steal admin credentials.
• Mail relay: By invoking a shortcode that sends email (e.g., a contact-form or notification shortcode) and controlling its attributes, the attacker makes the victim's server send emails to arbitrary recipients. This can be used to:
  • Deliver phishing emails from a legitimate-looking domain.
  • Trigger spam that damages the domain's sender reputation (SPF/DKIM/DMARC policies are bypassed because the mail is sent from the WordPress server itself).
  • Perform email bombing against a third party.
• Further exploitation: If the attacker can identify a shortcode with more powerful server-side effects (e.g., one that writes files, executes database queries, or modifies options), the same injection primitive could be escalated to full site compromise — though this depends on what shortcodes are registered on the specific target site.

Overall chain duration: A single HTTP request, no authentication, no browser interaction — exploitable in under a second per target at scale.

Impact Assessment

• Confidentiality (C:L): Partial disclosure of sensitive information. The primary confirmed leak is the administrator's email address on default installs. On non-default installs, shortcodes may expose additional user PII, database contents, or configuration values depending on the shortcode callbacks registered by other plugins/themes.

• Integrity (I:L): The attacker can cause the server to send emails with attacker-controlled content and recipients. While the attacker does not directly alter site files or database records, the mail relay abuse constitutes a modification of the site's outbound communications and can damage the domain's reputation. Additionally, because the arbitrary shortcode execution can invoke any registered shortcode, integrity impact could increase if a shortcode with write privileges exists.

• Availability (A:N): No direct denial-of-service impact; however, mail-relay abuse could lead to the domain being blacklisted by mail providers, indirectly disrupting legitimate transactional emails.

• Attack conditions per CVSS: Network (AV:N), Low complexity (AC:L), No privileges (PR:N), No user interaction (UI:N), Changed scope (S:U — scope is unchanged because the vulnerable component and the affected resource are in the same security authority).

• Affected systems: All WordPress installations running Kirki prior to version 6.2.1. The plugin is used as a dependency for many WordPress themes; therefore, the blast radius extends to any theme that bundles an outdated Kirki version — even if the site administrator never directly activates Kirki, its presence as a bundled dependency exposes the vulnerability.

• Blast radius estimate: Based on typical WordPress plugin adoption for theme frameworks (unknown exact install count), the affected install base is likely in the tens to hundreds of thousands of sites at the time of disclosure. The vulnerability is trivial to exploit at scale via automated scanning.

• EPSS context: An EPSS score of 0.00220 (12.6th percentile) indicates a low predicted probability of exploitation in the next 30 days according to the model — likely because no public exploit exists and the vulnerable plugin version is not yet widely deprecated. However, this low score does not diminish the severity; history shows that WordPress plugin vulnerabilities with simple exploit chains are routinely weaponized once disclosed publicly. CISA KEV status is NO — the vulnerability is not yet known to be exploited in the wild.

Detection Guidance

Sigma Rule

title: Kirki WordPress Plugin Unauthenticated Shortcode Injection Attempt
id: 9f3f8a1c-6d1e-4a7c-9b6f-3f7c9b8d2e11
status: experimental
description: Detects HTTP requests to WordPress REST routes that contain shortcode syntax, indicating a possible exploitation attempt of CVE-2026-16747 in the Kirki plugin.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16747
author: valtersit.com Threat Intelligence Team
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs (combined log format) or a WAF with URL decoding enabled.'
detection:
    selection_uri:
        cs-method: POST
        cs-uri-query|contains:
            - 'wp-json'
            - 'kirki'
    selection_shortcode:
        # Looking for WordPress shortcode bracket syntax in the request body or query params.
        cs-uri-query|contains:
            - '%5B'    # URL-encoded '[' character
            - '%5D'    # URL-encoded ']' character
        cs-body|contains:
            - '['
            - ']'
    filter_legit_shortcodes:
        # Exclude requests where the shortcode appears as part of normal post content (legitimate admin usage).
        cs-username|contains: 'admin'
    condition: selection_uri and selection_shortcode and not filter_legit_shortcodes
falsepositives:
    - Legitimate admin/editor usage of shortcodes in forms if the site uses Kirki's options to allow shortcode input.
    - WordPress REST API requests from other plugins that legitimately pass shortcode content.
level: medium

YARA Rule

rule WP_Kirki_CVE_2026_16747_Shortcode_Inject {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP request payloads containing shortcode patterns targeting the Kirki WordPress plugin REST routes."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16747"
        cve = "CVE-2026-16747"
        date = "2026-01-01"
        score = 60
    strings:
        $a = /\[[a-z_]+[^\]]*\]/ ascii wide nocase   // general shortcode: [shortcode ...]
        $b = "wp-json" ascii wide nocase
        $c = "kirki" ascii wide nocase
        $d = "do_shortcode" ascii wide nocase          // if payload includes function reference
    condition:
        (uint16(0) == 0x0d0a or uint16(0) == 0x0a0d) and
        any of ($b*) and any of ($c*) and any of ($a*) and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Kirki WordPress Plugin Unauthenticated Shortcode Injection (CVE-2026-16747)";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"wp-json";
    http_uri;
    content:"kirki";
    http_uri;
    # Look for URL-encoded or raw square brackets indicating shortcode syntax in either URI or body.
    pcre:"/(%5B|\[)[a-z_]+.*(%5D|\])/Ui";
    http_header;
    classtype:web-application-attack;
    sid:202616747;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-16747;
)

Elastic Detection

// Elastic EQL query to detect potential exploitation of CVE-2026-16747 in web server logs.
// Run against the filebeat-* index pattern with HTTP access logs ingested.
sequence by source.ip with maxspan=30s
    [ network where
        network.protocol == "http" and
        http.request.method == "POST" and
        url.path LIKE "*wp-json*kirki*" and
        url.query LIKE "*%5B*" or
        url.query LIKE "*%5D*" or
        url.query LIKE "*[a-z_]*"
    ]
    [ network where
        network.protocol == "http" and
        http.response.status_code == 200 and
        url.path LIKE "*wp-json*kirki*"
    ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| where like(uri_path, "%wp-json%") AND like(uri_path, "%kirki%")
| eval body_has_shortcode = if(match(form_data, "\[[a-z_]+\]"), 1, 0)
| eval query_has_shortcode = if(match(uri_query, "%5B[a-z_]+") OR match(uri_query, "\[[a-z_]+"), 1, 0)
| where body_has_shortcode=1 OR query_has_shortcode=1
| stats count by src_ip, uri_path, user_agent, _time
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100247" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*wp-json.*kirki.*</field>
    <field name="method">POST</field>
    <regex>(\[|\x5B)[a-z_]+</regex>
    <description>Potential exploitation of CVE-2026-16747: Unauthenticated shortcode injection attempt against Kirki WordPress plugin REST route.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,wordpress,</group>
  </rule>
</group>

Mitigation & Patch Guidance

1) Immediate mitigations (apply now):

• Block vulnerable REST routes at the WAF / reverse proxy level: deny HTTP POST requests to any path matching wp-json* that also contains the string kirki — until the exact route path is known, apply a broad rule and relax after analysis.
• Disable or deactivate the Kirki plugin if it is not actively required by the active theme. Many themes bundle Kirki as a dependency; the theme can often function with reduced options until the plugin is fixed.
• Add a server-side web application firewall rule that blocks request bodies containing [...] bracket patterns on wp-json routes (be careful to avoid breaking legitimate JSON payloads; decode URL-encoded content before matching).
• Monitor outgoing SMTP traffic from the WordPress server; implement rate limiting on the wp_mail() function via a security plugin to contain mail relay abuse.

2) Patch / upgrade steps:

• Upgrade the Kirki plugin to version 6.2.1 or later via the WordPress admin dashboard (Plugins → Installed Plugins → Kirki → Update) or via wp-cli: wp plugin update kirki.
• Audit all themes in use; if a theme bundles a copy of the Kirki plugin inside its /themes/{theme}/kirki/ directory, the theme update is also required (the bundled copy will not be auto-updated by WordPress core).
• After updating, verify the plugin version in the readme.txt or the plugin header — check that the version is ≥ 6.2.1.

3) Long-term hardening:

• Principle of least privilege for REST routes: audit all plugins for custom REST routes that process user input without capability checks; a security plugin can enforce nonce and permission checks on all wp-json POST requests.
• Restrict shortcode execution to trusted roles: consider installing a shortcode whitelisting plugin that restricts do_shortcode() from being called with arbitrary input on public-facing endpoints.
• Outbound email protection: configure SPF, DKIM, and DMARC aggressively so that mail relay abuse from the WordPress server cannot be used to spoof the domain to external recipients.
• Regular vulnerability scanning: subscribe to WordPress plugin security feeds and run a scanner that checks installed plugin versions against public CVE data.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16747 — Official CVE/NVD record with the vulnerability description, CVSS vector/cross-reference data, and CWE classification (CWE-74).
2. WordPress Plugin Repository — Kirki: https://wordpress.org/plugins/kirki/ — Official plugin listing; used to determine the fixed version (6.2.1) and changelog/history.
3. MITRE ATT&CK — T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — The primary adversary technique applicable to this unauthenticated REST endpoint exploit.
4. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html — Weakness classification reference for the shortcode injection mechanism.

Known threat actor campaigns / in-the-wild evidence:

• None observed. CISA KEV status is NO, EPSS score is low (0.00220), and no public exploit code, Nuclei template, or Metasploit module was identified at the time of writing. Exploitation status: Private/Unknown. Security teams should monitor for exploitation activity in the weeks following public disclosure, as WordPress plugin vulnerabilities with this exploit complexity (single-request, unauthenticated) are commonly weaponized within 30–60 days of patch availability.