CVE-2026-12723 in Kirki Plugin
Summary
by MITRE • 07/20/2026
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in the Kirki WordPress plugin affects versions prior to 6.0.12 and stems from a critical authorization flaw within its REST API implementation. This issue allows unauthenticated attackers to exploit a specific REST route that lacks proper access controls, enabling them to manipulate comment data on affected websites. The flaw represents a direct violation of authentication principles and demonstrates inadequate input validation within the plugin's API endpoints.
The technical implementation of this vulnerability involves an unchecked REST API endpoint that accepts comment modification requests without verifying user credentials or permissions. Attackers can leverage this weakness to overwrite existing comments with arbitrary content, effectively bypassing WordPress's built-in comment moderation systems. Additionally, they can create new comments that appear to originate from legitimate users, though these comments are pre-approved and do not require moderation approval. This manipulation occurs through the REST API interface without any authentication requirements, making it particularly dangerous for sites that rely on comment moderation workflows.
The operational impact of this vulnerability extends beyond simple content manipulation and represents a significant threat to website integrity and user trust. Unauthenticated users can inject malicious content into comment sections, potentially including spam, phishing links, or defamatory statements that appear to come from legitimate site visitors. The bypass of comment moderation creates an avenue for attackers to rapidly disseminate harmful information while maintaining the appearance of authenticity. This vulnerability undermines the security model of WordPress sites that depend on comment moderation as a protective mechanism against inappropriate content.
Mitigation strategies should focus on immediate plugin updates to version 6.0.12 or later, which addresses the authorization flaw through proper access control implementations. Security teams should also implement additional monitoring of REST API endpoints for unusual activity patterns and consider implementing rate limiting to prevent automated exploitation attempts. The vulnerability aligns with CWE-284 which describes insufficient access control in software systems, and it maps to ATT&CK technique T1078.1.1 related to valid accounts for privilege escalation. Organizations should conduct comprehensive security audits of their WordPress installations to identify other plugins that may exhibit similar authorization flaws, as this represents a common pattern in WordPress plugin development where REST API endpoints are not properly secured against unauthorized access attempts.