Executive brief
The Kirki WordPress plugin, which provides a framework for theme developers, contains a security flaw in its password reset functionality. An attacker can send a specially crafted request to a website using this plugin to trigger a password reset email containing malicious HTML content, such as fake login links. While the attacker cannot redirect the email to a new address, they can use this to trick registered users into visiting phishing sites or disclosing their credentials through a legitimate-looking system email.
Technical details
The Kirki plugin fails to sanitize or escape the 'emailSubject' and 'emailBody' parameters provided in POST requests to the '/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password' REST API endpoint. An unauthenticated attacker can obtain a required guest nonce from a public page and then submit a request containing arbitrary HTML. Because the plugin sends these emails as 'text/html', the injected tags are rendered by the recipient's email client. While the attack is limited to sending emails to the address already registered to a specific username, it allows for highly convincing phishing or credential harvesting attacks. The issue is fixed in version 6.0.12.
Affected products
- Kirki Kirki < 6.0.12
Timeline
- 2026-06-29: disclosed: Initial public disclosure by WPScan
- 2026-06-29: patched: Fixed in version 6.0.12
- 2026-07-20: advisory: NVD publication date