CVE-2026-12472: Kirki Plugin Authorization Bypass Enables Unauthenticated Phishing via Site Mail Server

Technical summary

CVE-2026-12472 is an authorization bypass vulnerability in the Kirki – Freeform Page Builder plugin affecting versions up to 6.0.11. The plugin fails to enforce authentication checks before processing email submissions through parameters emailSubject and emailBody. The emailSubject parameter receives only sanitize_text_field() treatment before passing to wp_mail(), insufficient to prevent header injection. EmailBody text items are concatenated directly into the HTML email body without escaping, enabling arbitrary HTML and JavaScript injection. The plugin can also embed genuine WordPress password-reset URLs (obtained via legitimate means) into 'chip' items, creating highly credible phishing messages. Unauthenticated attackers exploit these vectors to send HTML-injected emails via the site's mail server, leveraging the site's existing SPF/DKIM reputation to maximize delivery and credibility.

Business impact

This vulnerability significantly amplifies phishing risk against your user base. Because emails originate from your own mail server with valid SPF/DKIM signatures, they bypass traditional email reputation filters and appear legitimate. Attackers can craft convincing password-reset phishing messages targeting your administrators and users, potentially leading to account takeovers, data breaches, and reputational damage. The low barrier to exploitation—no authentication required—means this can be weaponized immediately by opportunistic attackers or competitors. The combination of your domain's mail reputation plus genuine password-reset URLs creates an exceptionally convincing attack surface.

Affected systems

Any WordPress site running Kirki – Freeform Page Builder plugin version 6.0.11 or earlier is vulnerable. No authentication or special permissions are required to trigger the exploit, making every installation an immediate target regardless of site configuration or user role restrictions. The vulnerability does not require specific WordPress configurations or third-party plugins to function.

Exploitability

Exploitability is high and requires minimal effort. The attack is network-accessible, requires no special conditions (AC:L), no user interaction (UI:N), and works against any unauthenticated visitor. The attacker needs only basic knowledge of HTTP requests and the ability to craft HTML-injected email payloads. Public disclosure or proof-of-concept tools would enable rapid, widespread exploitation. No active KEV exploitation has been reported at this time, but the technical simplicity and high success rate of phishing attacks make weaponization likely if exploitation details circulate.

Remediation

Upgrade the Kirki plugin to a version later than 6.0.11 (verify the specific patched version in the official plugin repository or vendor advisory). After patching, conduct a site audit to check for any unauthorized email activity in server logs dating back to deployment. Review user account activity for suspicious login attempts or password resets. Consider adding a Web Application Firewall (WAF) rule to block unauthorized email form submissions as a temporary layer. If an immediate patch is unavailable, disable the Kirki plugin entirely until a fix is released, or restrict access to the affected functionality via htaccess or security plugins.

Patch guidance

Update to the latest available version of Kirki from the official WordPress plugin repository. Before applying the patch to production, test in a staging environment to ensure compatibility with your active theme and other plugins. After patching, clear any caching layers (page cache, object cache) to ensure the new code is active. Verify the plugin version in the WordPress admin dashboard under Plugins. Document the patch date for compliance and audit records.

Detection guidance

Monitor web server access logs for unusual POST requests to the plugin's email submission endpoints (typically under /wp-content/plugins/kirki/). Look for requests with emailSubject or emailBody parameters from non-admin IP addresses or containing HTML/JavaScript payloads. Check SMTP/mail server logs for emails sent by the plugin's mail function with suspicious subjects or bodies, or originating from unauthenticated requests. Use WordPress security plugins to alert on unauthorized form submissions. If your site runs a WAF, examine blocked requests for patterns matching this exploit. Review user account logs for unexpected password-reset events during the vulnerability window.

Why prioritize this

Although the CVSS score is moderate (5.3), the practical risk is high: the vulnerability enables credential theft and account compromise through highly credible phishing, requires zero authentication, and exploits your organization's own mail reputation. The simplicity of exploitation and prevalence of Kirki (widely used on business and agency sites) make this a prioritized target for attackers. Immediate patching is warranted to prevent user credential compromise.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the integrity impact (I:L) of sending false or misleading emails, with no confidentiality or availability impact. However, this underweights the real-world risk: the vulnerability directly enables account compromise via phishing, which typically leads to confidentiality and integrity breaches. Organizations should treat this as a high-priority patch candidate due to the ease of exploitation and the effectiveness of the resulting phishing attacks, even though the base CVSS does not reach HIGH severity.

Frequently asked questions