Improper Validation Vulnerability in Themeum Kirki by Themeum
CVE-2026-103065

8.2HIGH

Key Information:

Vendor

WordPress
Status
Kirki
Vendor
CVE Published:
3 October 2026

What is CVE-2026-103065?

The Themeum Kirki plugin is susceptible to an improper validation vulnerability that allows an attacker to access functions that are not adequately constrained by access control lists (ACLs). This flaw enables unauthorized actions to be executed, potentially leading to arbitrary code execution. Users of Kirki versions prior to 6.3.1 are notably affected, highlighting the importance of prompt updates to secure their environments.

Affected Version(s)

Kirki 0 <= 6.3.1

References

https://patchstack.com/database/wordpress/plugin/kirki/vu...
vdb-entry

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dthangws | Patchstack Bug Bounty Program
.