EUVD-2026-45882
GHSA-f5q9-9w7q-q2jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Kirki < 6.0.12 installed
-
DeliveryEnumerate or guess existing comment IDs via public post pages
-
ExploitSend unauthenticated HTTP request to Kirki REST route
-
ExecutionBypass missing authorization check
-
ImpactOverwrite comment content or inject pre-approved spoofed comment
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required - any WordPress site with the Kirki plugin installed and active in a version below 6.0.12 is vulnerable by default, as the REST route is registered unconditionally on plugin load. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is fully unauthenticated with no user interaction needed. Exploitation is bounded by impact scope: only comment integrity is affected (C:N, A:N in CVSS), and the attacker must know or enumerate valid comment IDs to overwrite existing comments (though creating new spoofed comments requires no such knowledge). Sites with comments globally disabled in WordPress settings or without Kirki installed are not affected. |
| Impact | The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately captures the technical baseline: fully network-accessible, zero complexity, no authentication, limited integrity impact, no confidentiality or availability loss. EPSS is extremely low at 0.14% (4th percentile), suggesting limited observed in-the-wild activity at time of scoring. However, EPSS alone understates risk here: a public POC exists (confirmed by WPScan), and SSVC flags Automatable:yes with Technical Impact:partial, meaning mass automated scanning and exploitation is realistic. The low EPSS likely reflects the niche nature of comment integrity rather than technical difficulty. The absence of a CISA KEV listing suggests no confirmed widespread exploitation campaigns to date, but the combination of a trivial unauthenticated attack path, automation feasibility, and WordPress's enormous install base makes this a meaningful priority for any site running Kirki below 6.0.12. |
| Exploit ScenarioDerived | An attacker scripts an unauthenticated HTTP POST request to the exposed Kirki REST endpoint, targeting the ID of an existing comment to replace its content with spam, defacement, or disinformation, or submitting a new comment body with a spoofed author name and email that bypasses the site's comment moderation queue and appears immediately as an approved comment. Because a public POC exists and SSVC confirms the attack is automatable, this scenario is achievable at scale across many WordPress sites simultaneously using a simple scanner. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
RemediationAI
The primary fix is to update the Kirki WordPress plugin to version 6.0.12 or later, which introduces proper authorization checks on the affected REST route. The patch is confirmed available from the vendor per EUVD-2026-45882. As a compensating control before patching is feasible, administrators can restrict unauthenticated REST API access by hooking the WordPress rest_authentication_errors filter to require login for all REST requests - note this may break themes or plugins that legitimately rely on public REST endpoints, so test in staging first. Alternatively, a WAF or reverse proxy rule blocking unauthenticated POST/PUT requests to wp-json/ paths will prevent exploitation at the network layer with minimal site impact. Full advisory references: https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/ and https://nvd.nist.gov/vuln/detail/CVE-2026-12723.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kirki is a widely used WordPress framework plugin that enhances the WordPress Customizer with additional controls and fields. WordPress exposes plugin-registered routes via its REST API (wp-json/), which are accessible to unauthenticated clients unless the developer explicitly enforces capability checks or nonce verification. CWE-862 (Missing Authorization) describes exactly this failure: the plugin registers a REST route and neglects to validate whether the requestor has permission to perform the operation. The affected CPE is cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:* (vendor field unresolved in NVD), covering all Kirki versions from 0 up to 6.0.12. The flaw permits two distinct abuse primitives: content overwrite of existing comments (integrity violation) and creation of auto-approved comments under arbitrary identities (trust/moderation bypass).
Know when Kirki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
REST route exposed over network with no authentication required (PR:N, AV:N); impact limited to comment integrity (I:L), no confidentiality or availability loss confirmed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-leve
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Exploit-DB