Blocks public access to kirki/v1/frontend/* REST routes, which have an unpatched vulnerability.

kirki-disable-frontend-endpoints.php

<?php

/**
 * Plugin Name: Disable Kirki Front-End REST API
 * Description: Blocks public access to Kirki's kirki/v1/frontend/* REST routes, which have an unpatched vulnerability.
 * Network: true
 *
 * @link https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-13-broken-access-control-vulnerability
 *
 * @package security
 */

namespace Security\KirkiFrontendRest;

use WP_Error;
use WP_REST_Request;

const ROUTE_PREFIX = 'kirki/v1/frontend';

add_filter( 'rest_pre_dispatch', __NAMESPACE__ . '\\block_public_access', 10, 3 );

/**
 * Deny public requests to Kirki's front-end REST routes.
 *
 * Runs before the route's own permission_callback, so it hardens every
 * kirki/v1/frontend/* route regardless of what Kirki does internally.
 *
 * @param mixed            $result  Response to short-circuit with, or null to continue.
 * @param mixed            $server  REST server instance (unused).
 * @param WP_REST_Request  $request Current request.
 * @return mixed WP_Error to block, otherwise the untouched $result.
 */
function block_public_access( $result, $server, $request ) {
	// Respect an earlier handler that already resolved the request.
	if ( null !== $result ) {
		return $result;
	}

	if ( ! $request instanceof WP_REST_Request ) {
		return $result;
	}

	$route = ltrim( (string) $request->get_route(), '/' );

	if ( 0 !== strpos( $route, ROUTE_PREFIX ) ) {
		return $result;
	}

	if ( is_user_logged_in() && current_user_can( 'edit_posts' ) ) {
		return $result;
	}

	return new WP_Error(
		'kirki_frontend_rest_disabled',
		__( 'This endpoint is not available.', 'security' ),
		array( 'status' => rest_authorization_required_code() )
	);
}