Executive brief
Kirki is a popular WordPress plugin used by developers to build custom themes and component libraries. A security flaw in its component library feature allows unauthorized individuals to modify existing website comments or post new, pre-approved comments while pretending to be someone else. This can lead to the spread of misinformation, spam, or damage to a site's reputation by bypassing the standard comment moderation process.
Technical details
The Kirki plugin's REST API endpoint `/KirkiComponentLibrary/v1/kirki-comment` fails to perform proper authorization checks (CWE-862). While the endpoint expects a nonce, the nonce is publicly exposed in the page source of any Kirki Component Library page containing a comment element, allowing an unauthenticated attacker to scrape it. By providing this scraped nonce in the 'X-WP-Element-Nonce' header, an attacker can send POST requests to overwrite the content of arbitrary comment IDs or insert new comments with 'comment_approved' set to 1. This bypasses the standard WordPress comment moderation workflow and allows for identity spoofing. The issue is resolved in version 6.0.12.
Affected products
- Kirki Kirki < 6.0.12
Timeline
- 2026-06-29: disclosed: Initial disclosure by WPScan
- 2026-06-29: patched: Fix released in version 6.0.12
- 2026-07-20: advisory: NVD publication date