Kirki WordPress Plugin CVE-2026-12724

Exploitation requires the target WordPress site to have the Kirki plugin installed and active in a version below 6.0.12, with the plugin's password-reset email functionality enabled (default behavior). The attacker must supply a valid registered user's email address as the reset target - user enumeration is a prerequisite, either through WordPress's default username disclosure or brute-force of known addresses. No authentication is required to submit the malicious reset request (PR:N per CVSS). Exploitation is limited by: (1) the attacker needing a valid registered user email to address the injected email, (2) the victim must open and act on the delivered email (UI:R per CVSS), making this non-automatable at scale per SSVC. WordPress sites that have fully disabled password-reset emails via plugin or configuration, or that have removed user self-service account recovery, are not exploitable.

The CVSS 4.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) correctly captures the limited direct technical impact: no confidentiality breach, no code execution, no availability disruption - only injected HTML content delivered via email. Real-world risk is primarily social engineering amplification: the attacker leverages the trusted sending domain of the WordPress site to lend credibility to a phishing email. The EPSS of 0.10% at the 1st percentile is consistent with the phishing-oriented nature of the flaw - automated, opportunistic exploitation is not the typical attack pattern here. SSVC corroborates this: Automatable: no and Technical Impact: partial reflect the human-in-the-loop dependency and bounded blast radius. The publicly available POC (WPScan) raises the threat tier modestly above theoretical, but absence from CISA KEV means no confirmed active exploitation at time of analysis. This is a real but narrow risk: highest concern for sites with a known user base that attackers can enumerate and target individually.

An unauthenticated attacker submits a password-reset request to a vulnerable WordPress site, injecting an HTML anchor tag or fraudulent login form into the email subject or body parameter - for example, embedding a link redirecting to an attacker-controlled credential-harvesting page styled to mimic the legitimate site. The target registered user receives this email from the site's own trusted sending domain, increasing the likelihood of interaction, and may submit credentials to the attacker's infrastructure. A publicly available POC demonstrates this injection technique.