PT-2026-61526 · WordPress · Kirki

Tarcísio Luchesi · CVE-2026-12724 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kirki WordPress plugin versions prior to 6.0.12

Description Unauthenticated users can inject arbitrary HTML into password-reset emails sent to registered users. This occurs because the plugin fails to sanitize or escape the email subject and body values provided in a request before including them in the HTML message, which could facilitate phishing attacks.

Recommendations Update Kirki WordPress plugin to version 6.0.12 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-12724

Affected Products

Kirki

References · 3

• 🔥 https://wpscan.com/vulnerability/6c2d4489-de82-472d-a5f7-dc01b305fdd0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12724 · Security Note
• https://twitter.com/VulmonFeeds/status/2079150909997605105 · Twitter Post