CVE-2026-77754

Executive Summary

CVE-2026-77754 is an information disclosure vulnerability in the Kirki WordPress plugin prior to version 6.0.14. The flaw stems from missing capability checks on endpoints of a public AJAX action, allowing unauthenticated remote attackers to retrieve sensitive data including registered user email addresses, comment author emails, non-public page content, and plugin/theme settings. With a CVSS score of 5.3 (Medium) and an attack complexity of Low requiring no privileges or user interaction, this vulnerability is trivially exploitable against any WordPress site running an affected Kirki version. The impact is confidentiality-focused — no integrity or availability impact — but the exposure of email addresses and internal content can fuel phishing campaigns, targeted social engineering, and further reconnaissance against the affected organization.

Technical Analysis

The Kirki WordPress plugin is a widely adopted customizer framework that provides theme developers with an API for building WordPress Customizer panels, sections, and controls. Its popularity (over 400,000+ installations historically) makes it an attractive target for mass exploitation.

Vulnerability Mechanism: The NVD description states the plugin "does not perform a capability check on some endpoints of one of its public AJAX actions." This indicates a missing current_user_cans() or similar authorization validation within the callback handler for the AJAX action. The WordPress AJAX API distinguishes between wp_ajax_{action} (for authenticated users) and wp_ajax_nopriv_{action} (for unauthenticated users). The presence of a nopriv hook for the vulnerable action confirms that it is intentionally accessible to unauthenticated users; however, the callback function itself fails to re-verify that the requesting user has the appropriate permissions to perform the data retrieval.

Attack Surface: The attack surface is the public-facing AJAX endpoint exposed by the plugin. Since the action is registered as "public" (i.e., accessible without authentication), any remote attacker can directly invoke it via an HTTP POST/GET request to admin-ajax.php with the corresponding action parameter. The endpoint returns data that should be restricted to authenticated administrators or users with specific roles.

Data Exposed: Based on the NVD description, the exposed data includes:

1. Registered user email addresses — enables user enumeration and targeted phishing.
2. Comment author email addresses — provides additional PII of site commenters.
3. Non-public page content — may include draft pages, scheduled posts, private pages, or template files.
4. Non-public settings — may include theme options, customizer settings, API keys, or configuration data stored in WordPress options.

CWE-200 (Exposure of Sensitive Information): This vulnerability maps directly to CWE-200, which describes the unintended exposure of sensitive information to an actor that is not explicitly authorized to access that data. The missing capability check is the root cause; the attacker does not need to bypass authentication because the endpoint is already publicly accessible — the proper authorization verification is absent.

Insufficient technical detail: The NVD description does not specify which AJAX action is affected, the exact endpoints involved, or the parameter names. This level of abstraction is typical for vulnerabilities where the CNA has limited code-level detail. The attack mechanism is understood at the class level: missing authorization checks in a public AJAX handler.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker identifies WordPress sites running the Kirki plugin. This can be achieved via:

• WPScan or similar WordPress vulnerability scanners that fingerprint plugins.
• Examining page source for Kirki-generated CSS/JS references (e.g., kirki string in stylesheet URLs).
• Using Shodan/Censys queries to find WordPress sites with Kirki distinctive files.

Step 2 — Triggering the Flaw: The attacker sends a crafted HTTP request to the WordPress admin-ajax.php endpoint with the vulnerable AJAX action name. Because the action is registered as "public" (accessible pre-authentication), no session or credentials are required. The request would typically be a POST with the action parameter set to the vulnerable action name and additional parameters to specify the data target.

Step 3 — Payload/Execution: At the vulnerability-class level, the attacker exploits the missing capability check by directly invoking the AJAX endpoint. For example, if the endpoint is designed to retrieve user information or settings, the attacker includes the relevant parameters in the request. The server-side handler processes the request and returns the requested data in the HTTP response. No injection payload is required — this is a vulnerability of omission (missing authorization), not of improper input handling.

Step 4 — Post-Exploitation Impact: The attacker collects:

• Email addresses of registered users and comment authors, which can be used for phishing campaigns, credential stuffing, or sold on underground markets.
• Non-public page content, revealing site structure, draft business plans, or internal process documentation.
• Non-public settings, potentially exposing API keys, database credentials, or third-party integration secrets stored in plugin options.

This harvested intelligence can be used to craft highly convincing spear-phishing emails, perform account takeover attempts via credential stuffing, or inform targeted secondary attacks against the WordPress admin panel or associated services.

Note: No public PoC is available; attack chain is inferred from vulnerability class. The exact AJAX action name and request format are not disclosed in the available data.

Impact Assessment

Business Impact: The medium severity rating (CVSS 5.3) reflects the confidentiality-only impact. The vector details are: AV:N (Network), AC:L (Low complexity), PR:N (No privileges required), UI:N (No user interaction), S:U (Unchanged scope), C:L (Low confidentiality impact), I:N (No integrity impact), A:N (No availability impact). The low confidentiality sub-score indicates that while sensitive data is exposed, the volume or sensitivity of exposed data is somewhat limited.

Affected Systems: Any WordPress installation using Kirki versions prior to 6.0.14. Given Kirki's integration into many commercial and custom WordPress themes, the actual number of affected sites could be substantial.

Blast Radius: The exposed email addresses constitute PII that, if breached at scale across many sites, could trigger regulatory requirements (GDPR, CCPA) for breach notification. The exposure of non-public settings could leak API keys for services like payment gateways, SMTP servers, or external analytics — potentially enabling further lateral attacks into connected infrastructure. The low confidentiality rating suggests the practical impact is moderate, but for organizations in regulated industries or with high-value intellectual property in draft pages, the impact could be considerably higher.

Adversarial Value: This vulnerability provides a low-cost, low-risk information-gathering vector. The data harvested can substantially lower the barrier for targeted phishing and social engineering attacks against site users, including potentially high-value targets within the organization.

Detection Guidance

Sigma Rule

title: Kirki WordPress Plugin Unauthenticated Information Disclosure
id: 6a8f95c2-3e1b-4d7c-9f3a-2c5b8e7d1f4a
status: experimental
description: Detects attempts to exploit CVE-2026-77754 by accessing the vulnerable public AJAX action in Kirki plugin
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-77754
author: Valters IT Security Team
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'WordPress site running Kirki plugin < 6.0.14'
detection:
    selection_path:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action='
    selection_kirki:
        cs-uri-query|contains:
            - 'kirki'
            - 'get_users'
            - 'get_settings'
            - 'get_pages'
    selection_response:
        sc-status: '200'
    condition: selection_path and selection_kirki and selection_response
    timeframe: 5m
level: medium
falsepositives:
    - Legitimate admin actions on the same endpoint
    - Other plugins with similar AJAX action names
tags:
    - attack.t1190
    - cve.2026.77754
    - cwe.200

YARA Rule

rule CVE_2026_77754_Kirki_Exploit_Attempt
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects patterns in web server logs or network captures indicative of attempted exploitation of Kirki unauthenticated information disclosure"
        cve = "CVE-2026-77754"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77754"
        date = "2026-01-15"
        score = 60
    strings:
        $ajx = "admin-ajax.php" ascii wide nocase
        $act = "action=" ascii wide nocase
        $krk1 = "kirki_get_users" ascii wide nocase
        $krk2 = "kirki_settings" ascii wide nocase
        $krk3 = "kirki_page" ascii wide nocase
        $krk4 = "kirki" ascii wide nocase
        $prm = "nonce=" ascii wide nocase
    condition:
        ($ajx at 0..5000) and ($act in (0..filesize)) and any of ($krk*) and not $prm
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77754 Kirki WordPress Plugin Unauthenticated Information Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; nocase; content:"action="; http_uri; nocase; content:"kirki"; http_uri; nocase; pcre:"/action=(kirki_get_users|kirki_settings|kirki_page|kirki)/i"; sid:202677754; rev:1; classtype:attempted-recon; reference:cve,2026-77754; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77754; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Elastic Detection

sequence by source.ip
    with maxspan=5m
    [ network where event.type == "connection" and destination.port == 80 or destination.port == 443 ]
    [ http where
        http.request.method == "POST" and
        url.path contains "/admin-ajax.php" and
        url.query contains "action=" and
        url.query contains "kirki" and
        not (http.response.status_code == 403 or http.response.status_code == 401)
    ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%admin-ajax.php%")
| where like(form_data, "%action=%") 
| where like(form_data, "%kirki%")
| stats count by src_ip, uri, user_agent, _time
| where count > 3
| eval threat = "CVE-2026-77754 Kirki Information Disclosure Attempt"
| table _time, src_ip, uri, count, user_agent

Wazuh OSSEC Rule

<rule id="202677" level="10">
    <if_sid>31122</if_sid>
    <match>admin-ajax.php</match>
    <regex>action=kirki</regex>
    <description>CVE-2026-77754: Kirki WordPress plugin unauthenticated information disclosure attempt detected</description>
    <group>wordpress,cve_2026_77754,information_disclosure,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

1) Immediate Mitigations:

• Disable the vulnerable AJAX action — If the specific action name can be identified (through code audit or monitoring), add a filter to wp_ajax_nopriv_{action} to return an error for unauthenticated requests.
• Add a WAF rule — Implement a Web Application Firewall rule to block requests to admin-ajax.php that contain both action= and Kirki-related parameters from unauthenticated sessions.
• Limit exposure — If Kirki is only needed during theme development, consider deactivating the plugin in production environments.
• Monitor logs — Review web server and WordPress logs for abnormal requests to admin-ajax.php with unknown action parameters.
• Rotate exposed secrets — If settings data may already have been compromised, rotate any API keys or credentials stored in WordPress options (including third-party service keys).

2) Patch/Upgrade Steps:

• The NVD description indicates the fix is available in Kirki version 6.0.14. However, our patch confidence is 0/4 due to no tracked patch sources confirming availability.
• Verify patch availability: Check the official Kirki plugin repository page or GitHub repository for version 6.0.14.
• Upgrade procedure:
  • Backup all WordPress files and database.
  • Update the Kirki plugin via WordPress admin (Plugins → Installed Plugins → Update) or via WP-CLI: wp plugin update kirki.
  • Verify version 6.0.14 or higher is installed.
  • Re-test the site's customizer functionality to ensure no regressions.

3) Long-Term Hardening:

• Principle of least privilege — Enforce capability checks in all custom plugin code. Review all custom or third-party plugins for missing current_user_cans() in AJAX handlers.
• WordPress security plugin — Deploy a security plugin that enforces rate limiting and IP blocking on admin-ajax.php.
• Regular vulnerability scanning — Use WPScan or equivalent tools to identify outdated plugins.
• Patch management policy — Establish automated patch deployment for WordPress plugins, prioritizing plugin-level vulnerabilities.
• Email address minimization — Consider masking user email addresses on public-facing endpoints and using contact forms rather than exposing direct email addresses.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-77754
2. CWE-200 — Exposure of Sensitive Information: https://cwe.mitre.org/data/definitions/200.html
3. Kirki WordPress Plugin (Official Repository): https://wordpress.org/plugins/kirki/
4. WordPress AJAX API Documentation: https://developer.wordpress.org/plugins/javascript/enqueuing/
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No active exploitation campaigns or in-the-wild exploitation has been publicly documented at the time of this report. No exploit code has been released, and no PoC exists in public repositories. The vulnerability is considered unpatched and could become a target for opportunistic scanning once CVE details are more widely distributed across security research communities.