CVE-2026-77754: CWE-200 Information Exposure in Kirki

The Kirki WordPress plugin versions prior to 6.0.14 contain an information disclosure vulnerability (CWE-200) due to missing capability checks on some public AJAX action endpoints. This flaw permits unauthenticated attackers to retrieve sensitive information including email addresses of registered users and comment authors, along with non-public page content and configuration settings. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

Unauthenticated attackers can access sensitive information such as email addresses of registered users and comment authors, as well as non-public page content and settings. This exposure could facilitate further targeted attacks or privacy violations but does not directly impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to AJAX endpoints if possible or monitor for suspicious activity related to these endpoints.