CVE-2026-12724: Kirki WordPress plugin HTML injection in password reset email

CVE-2026-12724 · Severity: info · CVSS 4.3 · Published 2026-07-20

The Kirki WordPress plugin, which provides a framework for theme developers, contains a security flaw in its password reset functionality. An attacker can send a specially crafted request to a website using this plugin to trigger a password reset email containing malicious HTML content, such as fake login links. While the attacker cannot redirect the email to a new address, they can use this to trick registered users into visiting phishing sites or disclosing their credentials through a legitimate-looking system email.

Technologies: Kirki Framework Kirki Customizer Framework. Vendors: Kirki Framework.

Quick answers

Is CVE-2026-12724 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12724 being exploited in the wild.
How severe is CVE-2026-12724?
Informational severity, with a CVSS score of 4.3, published 20 July 2026.
Which products and versions are affected?
Kirki Framework Kirki Customizer Framework < 6.0.12.
Is there a fix for CVE-2026-12724?
A patch was published on 2026-06-29: Fixed in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12724 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12724?
Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Kirki plugin fails to sanitize or escape the 'emailSubject' and 'emailBody' parameters provided in POST requests to the '/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password' REST API endpoint. An unauthenticated attacker can obtain a required guest nonce from a public page and then submit a request containing arbitrary HTML. Because the plugin sends these emails as 'text/html', the injected tags are rendered by the recipient's email client. While the attack is limited to sending emails to the address already registered to a specific username, it allows for highly convincing phishing or credential harvesting attacks. The issue is fixed in version 6.0.12.

Affected products

  • Kirki Kirki < 6.0.12

Timeline

  • 2026-06-29: disclosed: Initial public disclosure by WPScan
  • 2026-06-29: patched: Fixed in version 6.0.12
  • 2026-07-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.