The Themeum Kirki plugin contains a high-severity access control vulnerability that enables unauthenticated attackers to potentially access sensitive information.

The vulnerability is identified as CWE-862 (Missing Authorization). It stems from a failure to validate user permissions, allowing unauthenticated remote attackers to interact with sensitive plugin functionalities.

The vulnerability carries a CVSS score of 7.5, indicating a high risk of unauthorized information disclosure. Successful exploitation could allow attackers to bypass security boundaries, leading to the exposure of sensitive site configurations or data, which may result in severe reputational damage and unauthorized access to backend settings.

Immediate Action: Update the Kirki plugin to the latest version beyond 6.0.13. If no patch is currently available, consider deactivating the plugin as a temporary measure.

Proactive Monitoring: Monitor site logs for unauthorized access attempts or suspicious queries associated with the Kirki plugin's endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that attempt to trigger unauthorized access to the plugin's internal functions.

Public Exploit Available: No

Given the high CVSS score and the nature of the flaw, administrators should treat this as a priority update. Immediate action is required to ensure that the plugin is patched to the latest version to prevent unauthorized data access by unauthenticated remote actors.