What is the CVSS score of CVE-2026-12472?

CVE-2026-12472 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

Kirki WordPress Plugin CVE-2026-12472

EUVD-2026-41267 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Wordfence

GHSA-7w58-pfxv-fq26

Authentication Bypass WordPress Kirki Freeform Page Builder Website Builder Customizer

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no auth (PR:N, AV:N), no complexity; integrity-only impact as no data is read and availability is unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:20 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails - including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user - to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.

AnalysisAI

Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.11) enables unauthenticated remote attackers to trigger arbitrary HTML-injected emails to any registered user via the site's own mail infrastructure. Because the email is dispatched through the site's authenticated SMTP path, it inherits the domain's SPF and DKIM reputation, substantially increasing phishing credibility. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Enumerate valid WordPress user email

Delivery

Send unauthenticated POST to Kirki form handler

Exploit

Missing auth check bypassed

Install

Inject HTML and password-reset chip into email body

wp_mail() dispatches phishing email via site SMTP

Execute

Victim clicks embedded reset link

Impact

Account takeover

Recon

Enumerate valid WordPress user email

Delivery

Send unauthenticated POST to Kirki form handler

Exploit

Missing auth check bypassed

Install

Inject HTML and password-reset chip into email body

wp_mail() dispatches phishing email via site SMTP

Execute

Victim clicks embedded reset link

Impact

Account takeover

Vulnerability AssessmentAI

Exploitation	No authentication or user session is required - the CVSS vector PR:N confirms this. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects the mechanical impact of unauthorized email dispatch and correctly scores this as Medium by strict metric definitions, but the real-world risk to end-users is meaningfully higher than the score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker enumerates a registered WordPress username or email address (via the standard WordPress login error message or user enumeration), then sends a crafted unauthenticated HTTP POST request to the Kirki form handler endpoint, supplying an attacker-authored emailSubject, HTML-injected emailBody text items, and a 'chip' item requesting inclusion of a genuine password-reset URL for the target account. The site's mail server dispatches the message with full SPF/DKIM authentication, making it appear to originate legitimately from the site; the victim receives a visually convincing email containing the real reset link embedded in attacker-controlled phishing content and is tricked into completing the reset on an attacker-controlled page.
Remediation	Update the Kirki plugin to a version beyond 6.0.11 immediately; the WordPress plugin repository changeset 3584702 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3584702%40kirki&new=3584702%40kirki) indicates an upstream fix has been committed, but an exact released version number was not confirmed in the available data - verify the current version in the WordPress Plugin Directory before applying. … Detailed patch versions, workarounds, and compensating controls in full report.