Is CVE-2026-12723 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12723 being exploited in the wild.

How severe is CVE-2026-12723?

Informational severity, with a CVSS score of 5.3, published 20 July 2026.

Is there a fix for CVE-2026-12723?

A patch was published on 2026-06-29: Fix released in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12723 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12723?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12723: Kirki WordPress plugin missing authorization in Component Library REST route

CVE-2026-12723 · Severity: info · CVSS 5.3 · Published 2026-07-20

Kirki is a popular WordPress plugin used by developers to build custom themes and component libraries. A security flaw in its component library feature allows unauthorized individuals to modify existing website comments or post new, pre-approved comments while pretending to be someone else. This can lead to the spread of misinformation, spam, or damage to a site's reputation by bypassing the standard comment moderation process.

Quick answers

Is CVE-2026-12723 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12723 being exploited in the wild.
How severe is CVE-2026-12723?: Informational severity, with a CVSS score of 5.3, published 20 July 2026.
Which products and versions are affected?: Kirki Kirki < 6.0.12.
Is there a fix for CVE-2026-12723?: A patch was published on 2026-06-29: Fix released in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12723 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12723?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Kirki plugin's REST API endpoint `/KirkiComponentLibrary/v1/kirki-comment` fails to perform proper authorization checks (CWE-862). While the endpoint expects a nonce, the nonce is publicly exposed in the page source of any Kirki Component Library page containing a comment element, allowing an unauthenticated attacker to scrape it. By providing this scraped nonce in the 'X-WP-Element-Nonce' header, an attacker can send POST requests to overwrite the content of arbitrary comment IDs or insert new comments with 'comment_approved' set to 1. This bypasses the standard WordPress comment moderation workflow and allows for identity spoofing. The issue is resolved in version 6.0.12.

Affected products

Kirki Kirki < 6.0.12

Timeline

2026-06-29: disclosed: Initial disclosure by WPScan
2026-06-29: patched: Fix released in version 6.0.12
2026-07-20: advisory: NVD publication date

References

https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.