Kirki WordPress Plugin CVE-2026-12472

No authentication or user session is required - the CVSS vector PR:N confirms this. The vulnerability is triggered by sending an HTTP POST request to the Kirki ComponentLibrary form handler endpoint, which is network-accessible on any WordPress installation running the plugin. The site must have a functioning outbound mail server (wp_mail() must be operational) for the email delivery aspect to succeed; sites with disabled or sandboxed mail will not deliver the phishing message, limiting impact to a failed send. The attack does require the attacker to know or enumerate a valid registered WordPress username or email address to target. No specific non-default configuration is required - the vulnerable code path is active in the default plugin installation for all versions through 6.0.11. Limiting factors: exploitation is constrained to sites with Kirki installed and active, a working outbound mailer, and at least one registered user account whose address or username the attacker can identify.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects the mechanical impact of unauthorized email dispatch and correctly scores this as Medium by strict metric definitions, but the real-world risk to end-users is meaningfully higher than the score suggests. No EPSS score was provided in the input, and no KEV listing is present, so exploitation probability and active-threat status cannot be quantified numerically. However, the attack chain is trivially automatable: any unauthenticated HTTP POST triggers the missing auth check, no special network position or knowledge is required, and the resulting email is cryptographically signed by the target site's mail server, bypassing standard phishing filters. The ability to embed a real WordPress password-reset URL - not a forged one - inside attacker-controlled HTML is a distinguishing factor that elevates practical phishing success rates well beyond typical email injection vulnerabilities. CVSS C:N is defensible because the attacker does not directly read any secret material, but the integrity impact (I:L) understates the account-takeover risk enabled by the phishing lure. No POC has been confirmed, but the vulnerability is straightforward to exploit independently given the trac source code is publicly browsable. Security teams should treat this as operationally higher priority than raw CVSS implies, particularly for sites hosting sensitive user data.

An attacker enumerates a registered WordPress username or email address (via the standard WordPress login error message or user enumeration), then sends a crafted unauthenticated HTTP POST request to the Kirki form handler endpoint, supplying an attacker-authored emailSubject, HTML-injected emailBody text items, and a 'chip' item requesting inclusion of a genuine password-reset URL for the target account. The site's mail server dispatches the message with full SPF/DKIM authentication, making it appear to originate legitimately from the site; the victim receives a visually convincing email containing the real reset link embedded in attacker-controlled phishing content and is tricked into completing the reset on an attacker-controlled page.