# CVE-2026-12723: Kirki WordPress plugin missing authorization in Component Library REST route

Source: https://junglewise.ai/threats/cve-2026-12723-kirki-wordpress-plugin-missing-authorization-in-component-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-12723 · Severity: info · CVSS 5.3 · Published 2026-07-20

Kirki is a popular WordPress plugin used by developers to build custom themes and component libraries. A security flaw in its component library feature allows unauthorized individuals to modify existing website comments or post new, pre-approved comments while pretending to be someone else. This can lead to the spread of misinformation, spam, or damage to a site's reputation by bypassing the standard comment moderation process.

## Quick answers

**Is CVE-2026-12723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12723 being exploited in the wild.

**How severe is CVE-2026-12723?** Informational severity, with a CVSS score of 5.3, published 20 July 2026.

**Which products and versions are affected?** Kirki Kirki < 6.0.12.

**Is there a fix for CVE-2026-12723?** A patch was published on 2026-06-29: Fix released in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12723 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12723?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kirki plugin's REST API endpoint `/KirkiComponentLibrary/v1/kirki-comment` fails to perform proper authorization checks (CWE-862). While the endpoint expects a nonce, the nonce is publicly exposed in the page source of any Kirki Component Library page containing a comment element, allowing an unauthenticated attacker to scrape it. By providing this scraped nonce in the 'X-WP-Element-Nonce' header, an attacker can send POST requests to overwrite the content of arbitrary comment IDs or insert new comments with 'comment_approved' set to 1. This bypasses the standard WordPress comment moderation workflow and allows for identity spoofing. The issue is resolved in version 6.0.12.

## Affected products

- Kirki Kirki < 6.0.12

## Timeline

- 2026-06-29: disclosed: Initial disclosure by WPScan
- 2026-06-29: patched: Fix released in version 6.0.12
- 2026-07-20: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/](https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/)