EUVD-2026-45882
GHSA-f5q9-9w7q-q2jv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
REST route exposed over network with no authentication required (PR:N, AV:N); impact limited to comment integrity (I:L), no confidentiality or availability loss confirmed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
AnalysisAI
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.
Technical ContextAI
Kirki is a widely used WordPress framework plugin that enhances the WordPress Customizer with additional controls and fields. WordPress exposes plugin-registered routes via its REST API (wp-json/), which are accessible to unauthenticated clients unless the developer explicitly enforces capability checks or nonce verification. CWE-862 (Missing Authorization) describes exactly this failure: the plugin registers a REST route and neglects to validate whether the requestor has permission to perform the operation. The affected CPE is cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:* (vendor field unresolved in NVD), covering all Kirki versions from 0 up to 6.0.12. The flaw permits two distinct abuse primitives: content overwrite of existing comments (integrity violation) and creation of auto-approved comments under arbitrary identities (trust/moderation bypass).
RemediationAI
The primary fix is to update the Kirki WordPress plugin to version 6.0.12 or later, which introduces proper authorization checks on the affected REST route. The patch is confirmed available from the vendor per EUVD-2026-45882. As a compensating control before patching is feasible, administrators can restrict unauthenticated REST API access by hooking the WordPress rest_authentication_errors filter to require login for all REST requests - note this may break themes or plugins that legitimately rely on public REST endpoints, so test in staging first. Alternatively, a WAF or reverse proxy rule blocking unauthenticated POST/PUT requests to wp-json/ paths will prevent exploitation at the network layer with minimal site impact. Full advisory references: https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/ and https://nvd.nist.gov/vuln/detail/CVE-2026-12723.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-leve
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today