The CVSS 6.5 assigned to this vulnerability is analytically misleading. It anchors to a default WordPress installation where shortcode execution is limited to admin email disclosure and mail relay—but production sites are rarely default installs. The real attack surface is the pre-auth arbitrary shortcode execution primitive itself: any shortcode registered by any plugin on your site becomes reachable by an unauthenticated attacker who controls its parameters. File managers, user management utilities, privilege escalation routines, stored XSS vectors—all become exploitable pre-auth.
This isn't merely a Kirki bug. It's an architectural violation where two incompatible trust models collided. The WordPress shortcode API was designed with an implicit security boundary: shortcodes execute within an authenticated admin context. REST endpoints operate under different access control rules. When Kirki exposed shortcode execution through unauthenticated REST routes, it violated an assumption the entire plugin ecosystem relies on. Every developer who registered a shortcode expecting authenticated execution just had their plugin's attack surface quietly expanded.
The EPSS score of 0.00222 reflects the present moment—a narrow window where the primitive exists but mass-exploitation tooling hasn't caught up. That window closes quickly. Shortcode names are opaque, requiring enumeration, but enumeration is a one-time cost against persistent targets. Within 60 days of disclosure, someone will publish a shortcode dictionary for this exploitation path. Patient attackers targeting high-value sites aren't deterred by low EPSS probabilities.
For defenders: audit which shortcodes are registered on your installation, particularly from plugins that provide file operations, database writes, privilege management, or eval capabilities. Assume any registered shortcode is reachable pre-auth. The CVSS scores the floor of this vulnerability; your specific plugin ecosystem determines the ceiling. Prioritize accordingly.