PT-2026-61525 · WordPress · Kirki

Shivamani Vastrala · CVE-2026-12723 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kirki WordPress plugin versions prior to 6.0.12

Description An authorization bypass exists in a REST route that allows unauthenticated users to overwrite the content of existing comments. Additionally, attackers can create pre-approved comments using a spoofed identity, which enables them to bypass standard comment moderation processes.

Recommendations Update Kirki WordPress plugin to version 6.0.12 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12723

Affected Products

Kirki

References · 3

• 🔥 https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12723 · Security Note
• https://twitter.com/VulmonFeeds/status/2079138108293955593 · Twitter Post