# CVE-2026-12724: Kirki WordPress plugin HTML injection in password reset email

Source: https://junglewise.ai/threats/cve-2026-12724-kirki-wordpress-plugin-html-injection-in-password-reset-email  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-12724 · Severity: info · CVSS 4.3 · Published 2026-07-20

The Kirki WordPress plugin, which provides a framework for theme developers, contains a security flaw in its password reset functionality. An attacker can send a specially crafted request to a website using this plugin to trigger a password reset email containing malicious HTML content, such as fake login links. While the attacker cannot redirect the email to a new address, they can use this to trick registered users into visiting phishing sites or disclosing their credentials through a legitimate-looking system email.

Technologies: [Kirki Framework Kirki Customizer Framework](https://junglewise.ai/threats/technologies/kirki-customizer-framework). Vendors: [Kirki Framework](https://junglewise.ai/threats/vendors/kirki-framework).

## Quick answers

**Is CVE-2026-12724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12724 being exploited in the wild.

**How severe is CVE-2026-12724?** Informational severity, with a CVSS score of 4.3, published 20 July 2026.

**Which products and versions are affected?** Kirki Framework Kirki Customizer Framework < 6.0.12.

**Is there a fix for CVE-2026-12724?** A patch was published on 2026-06-29: Fixed in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12724 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12724?** Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kirki plugin fails to sanitize or escape the 'emailSubject' and 'emailBody' parameters provided in POST requests to the '/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password' REST API endpoint. An unauthenticated attacker can obtain a required guest nonce from a public page and then submit a request containing arbitrary HTML. Because the plugin sends these emails as 'text/html', the injected tags are rendered by the recipient's email client. While the attack is limited to sending emails to the address already registered to a specific username, it allows for highly convincing phishing or credential harvesting attacks. The issue is fixed in version 6.0.12.

## Affected products

- Kirki Kirki < 6.0.12

## Timeline

- 2026-06-29: disclosed: Initial public disclosure by WPScan
- 2026-06-29: patched: Fixed in version 6.0.12
- 2026-07-20: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/6c2d4489-de82-472d-a5f7-dc01b305fdd0/](https://wpscan.com/vulnerability/6c2d4489-de82-472d-a5f7-dc01b305fdd0/)

## Related threats

- [Kirki WordPress plugin SQL injection](https://junglewise.ai/threats/cve-2026-12721-kirki-wordpress-plugin-sql-injection)
- [Kirki WordPress plugin PHP Object Injection](https://junglewise.ai/threats/cve-2026-12720-kirki-wordpress-plugin-php-object-injection)
- [Kirki WordPress plugin SSRF in kirki_get_apis](https://junglewise.ai/threats/cve-2026-13147-kirki-wordpress-plugin-ssrf-in-kirki-get-apis)
- [Kirki Freeform Page Builder privilege escalation via account takeover](https://junglewise.ai/threats/cve-2026-8206-kirki-freeform-page-builder-privilege-escalation-via-account)
- [Kirki WordPress Plugin authorization bypass in AJAX forms](https://junglewise.ai/threats/cve-2026-8096-kirki-wordpress-plugin-authorization-bypass-in-ajax-forms)