CVE-2026-12472: Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wpmail() with only sanitizetextfield() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kirki – Freeform Page Builder, Website Builder & Customizer (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.0.11 - Compensating control
Temporarily block/limit outbound mail relay opportunities from the WordPress application to reduce phishing impact (e.g., restrict egress/SMTP so unauthenticated attackers cannot send arbitrary email through the site’s mail server).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12472?
The severity of CVE-2026-12472 is medium with a score of 5.3.
How do I fix CVE-2026-12472?
To fix CVE-2026-12472, upgrade the Kirki WordPress plugin to version 6.0.12 or later.
What is the impact of CVE-2026-12472?
CVE-2026-12472 allows unauthenticated users to perform arbitrary email content injection, leading to potential mail relay or phishing attacks.
Who is affected by CVE-2026-12472?
Anyone using Kirki plugin versions up to and including 6.0.11 on their WordPress site is affected by CVE-2026-12472.
What parameters are involved in CVE-2026-12472?
CVE-2026-12472 is related to the 'emailBody' and 'emailSubject' parameters which lack proper authorization verification.