CVE-2026-84220

Executive Summary

CVE-2026-84220 is a vulnerability in the Kirki WordPress plugin (versions before 6.3.2) in which text held inside comments is passed to shortcode rendering without proper handling, and comments are displayed irrespective of their moderation status. This lets an unauthenticated visitor both execute shortcodes already registered on the target site and read private custom fields belonging to the page being viewed. Because exploitation requires no authentication and no user interaction, any WordPress site running a vulnerable Kirki build with registered shortcodes or private custom fields in use is exposed, though the CVSS score (4.8) reflects high attack complexity and low confidentiality/integrity impact.

Technical Analysis

Kirki is a WordPress plugin widely used as a toolkit for building theme options and customizer controls. In the affected versions, the plugin processes content originating from comments and renders shortcodes contained within that content. Two distinct defects are described:

1. Unfiltered shortcode execution on comment-derived content. The plugin "does not prevent shortcodes held in comments from being executed when it renders them." In WordPress, shortcodes are macros embedded in post/comment text and expanded server-side by the do_shortcode mechanism into whatever output the registered shortcode callback produces. If comment content reaches that rendering path without the standard guard that suppresses shortcode expansion for untrusted input, an attacker-supplied comment can cause any shortcode registered on the site to run.

2. Moderation-status bypass on comment display. The plugin "displays comments regardless of their moderation status." Normally, WordPress withholds comments pending moderation or marked as spam from public view. Because the plugin renders comments without honoring that status, an attacker's freshly submitted comment is visible (and therefore processed) even before a moderator approves it.

The combination is what makes the issue exploitable by an "unauthenticated visitor": the attacker submits a comment containing a shortcode, the plugin renders it without the moderation gate and without neutralizing shortcode syntax, and the registered shortcode callback executes. The same rendering path also "read[s] private custom fields of the page being viewed," meaning shortcode output associated with page metadata (custom fields) that are not intended for public disclosure can be surfaced to the comment author.

The specific shortcode tag names, callback function names, and code paths are not disclosed in the NVD description and are therefore not asserted here. No CWE was assigned in the source data; the behavior is consistent with improper neutralization of special elements / code injection (e.g., CWE-94 or CWE-79 for the rendered output class), but this report does not assign a definitive CWE beyond what the data supports.

Attack surface: the public comment-submission and comment-display path of the WordPress front end on sites with the vulnerable plugin installed and active, where at least one shortcode is registered (which is the default state for most WordPress installs, as core and numerous plugins register shortcodes). The CVSS AC:H (High attack complexity) suggests the exploit depends on conditions — for example, a specific shortcode being registered whose behavior is useful to the attacker, or particular custom fields being present — which an attacker must discover and satisfy.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public PoC exists; the chain is described at the vulnerability-class level. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running Kirki before version 6.3.2. This is inferable from publicly served plugin assets and typical CMS enumeration. The attacker then determines which shortcodes are registered on the site (registered shortcodes are observable indirectly through rendered pages) and whether the page being viewed exposes custom fields that would be valuable.

2. Triggering the flaw class. The attacker submits a comment to a page through the site's normal, publicly accessible comment form — no authentication is required. The payload is comment text containing shortcode syntax. Because the plugin renders shortcodes held in comments and displays comments regardless of moderation status, the comment does not need to be approved before it is rendered and its shortcodes executed.

3. Execution method (class level). When the vulnerable plugin renders the comment content, the embedded shortcode is expanded by WordPress's shortcode engine. This executes the callback of whichever shortcode tag the attacker placed in the comment. The attacker cannot register new shortcodes — they can only invoke shortcodes already registered on the target site — so the practical impact depends on what those callbacks do (for example, outputting data, embedding content, or interacting with page metadata).

4. Post-exploitation impact. Two outcomes are described: (a) execution of site-registered shortcodes, potentially causing content injection or disclosure depending on the callback; and (b) reading of private custom fields belonging to the page being viewed, a confidentiality loss of page metadata not meant to be public. There is no description of remote code execution, privilege escalation, or persistence in the source data, and none is asserted here.

Impact Assessment

The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N — score 4.8 (Medium).

• AV:N — exploitable over the network (public comment interface).
• AC:H — high attack complexity; success depends on site-specific conditions such as which shortcodes are registered and what custom fields exist.
• PR:N — no privileges required; the attacker is an unauthenticated visitor.
• UI:N — no victim interaction required.
• S:U — impact is scoped to the vulnerable component.
• C:L — limited confidentiality impact (private custom fields of the viewed page, plus whatever the executed shortcode output reveals).
• I:L — limited integrity impact (shortcode execution can alter page output/content).
• A:N — no availability impact described.

Business impact: Exposure of page-level custom fields can leak information an organization intended to keep non-public (contact metadata, configuration values, or editorial data stored in custom fields). Execution of registered shortcodes may permit content injection or abuse of other plugins' functionality. Blast radius: any publicly reachable WordPress site with the vulnerable Kirki plugin active. Exploitation does not require a logged-in account, so the population of potential attackers is effectively the entire internet. The limited CIA subscores cap severity, but the lack of a CISA KEV listing and absence of a public PoC do not reduce the need to patch, since the flaw is confirmed in the plugin's NVD description.

Detection Guidance

Sigma Rule

title: Kirki WordPress Plugin Shortcode Execution via Comment Rendering (CVE-2026-84220)
id: 8f2c1b6e-4a1d-4c7e-9b3a-1e6d2f0a9c11
status: experimental
description: Detects unauthenticated comment submissions containing shortcode syntax on sites running the affected Kirki plugin, consistent with CVE-2026-84220 shortcode execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84220
author: valtersit.com
date: 2026-01-01
logsource:
  product: webserver
  service: access_combined
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - 'wp-comments-post.php'
      - 'wp-json'
  selection_shortcode:
    cs-uri-query|contains: '['
  condition: selection_method and selection_uri and selection_shortcode
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate comments that legitimately contain bracketed text
  - Plugins delivering post bodies via JSON where '[' appears in benign payloads
level: medium
tags:
  - attack.t1190
  - cve.2026.84220

YARA Rule

rule CVE_2026_84220_Kirki_Comment_Shortcode
{
    meta:
        description = "Detects shortcode-bearing comment payloads targeting the Kirki WordPress plugin shortcode execution flaw (CVE-2026-84220)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84220"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $sc1 = "[" ascii
        $sc2 = "]" ascii
        $kirki = "kirki" ascii nocase
        $comment = "comment_content" ascii nocase

    condition:
        uint16(0) == 0x0A0D or true
        and $sc1 and $sc2
        and ($kirki or $comment)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84220 Kirki WordPress Plugin Comment Shortcode Execution Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-comments-post.php"; http_client_body; content:"["; pcre:"/\[\/?[a-zA-Z0-9_\-]{1,64}[^\]]*\]/P"; reference:cve,2026-84220; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84220; classtype:web-application-attack; sid:2026842201; rev:1; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST"
      and url.path : "wp-comments-post.php" ]
  [ network where network.protocol == "http" and http.request.body.content :
      "*[*]*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_comment = if(like(cs_uri_stem, "%wp-comments-post.php%"), 1, 0)
| eval has_bracket = if(match(_raw, "\[\/?[a-zA-Z0-9_\-]+[^\]]*\]"), 1, 0)
| where is_comment=1 AND has_bracket=1
| stats count values(cs_uri_query) as queries values(cs_useragent) as user_agents by clientip
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-84220,">
  <rule id="2026842" level="6">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>wp-comments-post.php</url>
    <description>CVE-2026-84220: Possible Kirki WordPress plugin shortcode execution via comment submission</description>
    <group>cve_2026_84220,attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The following is conservative guidance until a vendor patch is verified.

1. Immediate mitigations

   • Update the Kirki plugin to 6.3.2 or later if and only if a build is available from the official WordPress.org plugin repository; verify the version after install (the NVD description states the flaw affects versions "before 6.3.2").
   • If an update is not yet available or cannot be verified, deactivate the Kirki plugin until the fixed build is confirmed. Assess the theme dependency before doing so.
   • Restrict the public comment surface: disable comments on affected pages or require comment moderation/registration, which removes the unauthenticated submission path described in the NVD text.
   • Deploy a WAF or virtual patching rule that blocks comment bodies containing shortcode ([...]) syntax, accepting the false-positive risk to legitimate bracketed text.
   • Remove or minimize the use of private custom fields on pages that are publicly viewable, to limit the confidentiality impact described.

2. Patch / upgrade steps

   • Confirm the current Kirki version from the WordPress admin or via the plugin file metadata.
   • Take a full database and filesystem backup.
   • Update via the official channel, then re-verify the installed version and re-test comment rendering behavior.
   • Re-enable the plugin only after the fixed version is confirmed active.

3. Long-term hardening

   • Maintain a plugin inventory and version-pinning policy with timely update SLAs for internet-facing WordPress components.
   • Disable or tightly moderate anonymous commenting where it is not a business requirement.
   • Apply least-privilege to theme/plugin configurations and audit which shortcodes are registered on public pages.
   • Monitor web logs for comment submissions containing bracket syntax and correlate with the detection rules above.

References

• NVD — CVE-2026-84220: https://nvd.nist.gov/vuln/detail/CVE-2026-84220
• WordPress.org Plugin Repository — Kirki: https://wordpress.org/plugins/kirki/
• WordPress Developer Reference — Shortcode API: https://developer.wordpress.org/plugins/shortcodes/
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84220 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is available as of this report. No CISA KEV listing, and no known threat actor campaign or in-the-wild exploitation evidence for CVE-2026-84220 has been identified in the source data.