CVE-2026-103065 HIGH

CVE-2026-103065: WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

Vendor Themeum

Product Kirki

Weakness CWE-1284

Published October 3, 2026

Last update October 3, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

Key dates

02Disclosure timeline

October 3, 2026 CVE published

October 3, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-103065 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1284.html AskarLabs — CWE-1284 write-up Improper Validation of Specified Quantity in Input

Related vulnerabilities

04Related CVE

CVE-2026-49777 WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability CVE-2022-4171 demon image annotation <= 5.0 - Improper Input Restriction Validation CVE-2025-32689 WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerability CVE-2026-27384 WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability CVE-2026-25345 WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability