The Kirki WordPress plugin contains a flaw that allows unauthenticated users to trigger the execution of any shortcode present on the site via comments. Because the plugin renders comments without validating moderation status and does not strip or escape shortcode tags, an attacker can embed a shortcode in a comment and cause it to execute on page render. Shortcodes can run arbitrary PHP code, so this flaw leads to remote code execution. Additionally, the plugin displays comments regardless of moderation, leaking private custom fields from the viewed page. This vulnerability is prototypical of Improper Access Control (CWE-284) and Information Exposure (CWE-200).

The affected product is the Kirki plugin for WordPress, versions earlier than 6.3.2. Site owners should verify the installed plugin version and upgrade to 6.3.2 or later, which contains the remediation that blocks shortcode execution from comments and respects comment moderation.

The CVSS base score for this issue is 4.8, indicating a medium severity. The EPSS score is unavailable, but the lack of authentication makes the attack vector public and the ability to craft a comment easily. The vulnerability is not yet flagged in the CISA KEV catalog. An attacker could simply post a comment containing a malicious shortcode, resulting in execution of registered code or exposure of sensitive fields when the page loads. The risk is heightened on sites with many active shortcodes or sensitive custom metadata.