The vulnerability identified as CVE-2026-57727 affects the Themeum Kirki plugin through missing authorization controls. Specifically, versions up to 6.0.13 are impacted by incorrectly configured access control security levels, allowing remote attackers to access sensitive information without authentication or user interaction. The CVSS 3.1 base score is 7.5, reflecting a high severity due to the network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker can remotely exploit this vulnerability without any privileges or user interaction to gain unauthorized access to sensitive information, resulting in a high confidentiality impact. There is no impact on integrity or availability reported. This could lead to data exposure or leakage within affected Kirki plugin installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Kirki plugin administration interfaces and monitor for unusual access patterns. Avoid exposing the plugin to untrusted networks where possible.