CVE-2026-12723: Kirki WordPress Auth Bypass Vulnerability

CVE-2026-12723 Overview

CVE-2026-12723 is a missing authorization vulnerability [CWE-862] in the Kirki WordPress plugin versions prior to 6.0.12. The plugin exposes a REST API route that fails to perform any authorization check. Unauthenticated attackers can invoke the endpoint over the network to overwrite arbitrary existing comments and create new pre-approved comments under spoofed identities. This behavior bypasses standard WordPress comment moderation controls.

Critical Impact
Unauthenticated remote attackers can tamper with comment content and inject pre-approved comments impersonating legitimate users, enabling reputation abuse, misinformation, and phishing lure delivery through trusted site channels.

Affected Products

Kirki WordPress plugin versions before 6.0.12
WordPress sites bundling Kirki as a theme customizer dependency
Themes that ship Kirki as an embedded library

Discovery Timeline

2026-07-20 - CVE-2026-12723 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-12723

Vulnerability Analysis

The Kirki plugin registers a REST API route without an accompanying permission_callback that validates the caller's identity or capabilities. WordPress REST routes rely on this callback to gate write operations. When the callback is absent or returns true unconditionally, any anonymous client on the network can invoke the handler.

The vulnerable handler accepts input that maps to existing comment records and to new comment insertions. Because no capability check runs, the handler treats requests from unauthenticated visitors as trusted. Attackers can overwrite the comment_content field of arbitrary comments and insert new comments with comment_approved = 1, skipping the moderation queue.

The issue produces integrity impact without directly exposing confidential data or halting the service, which aligns with the network-reachable, low-complexity, no-privileges profile of the flaw. The EPSS score is 0.203%.

Root Cause

The root cause is a missing authorization check on a REST route registered by the plugin. The route lacks a permission_callback enforcing current_user_can() against an appropriate capability such as moderate_comments or edit_comment. This maps directly to CWE-862: Missing Authorization.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable Kirki REST endpoint on a target WordPress site. The request references a target comment identifier or supplies fields for a new comment, along with a spoofed author name and email. The server accepts the request without authenticating the caller and either overwrites the referenced comment or inserts a new pre-approved comment attributed to the spoofed identity.

See the WPScan Vulnerability Report for the endpoint details and reproduction steps.

Detection Methods for CVE-2026-12723

Indicators of Compromise

Unauthenticated POST requests to Kirki REST routes under /wp-json/ originating from unfamiliar IP addresses
Comments whose comment_content changed without a corresponding administrator or author session in access logs
New approved comments with author metadata that does not match any registered user account
Sudden spikes in approved comments containing outbound links or promotional content

Detection Strategies

Review web server access logs for anonymous requests to Kirki-registered REST endpoints and correlate with database write timestamps
Compare current wp_comments records against backups to identify silent overwrites of comment_content
Alert on approved comments that bypass the standard wp-comments-post.php submission path

Monitoring Recommendations

Enable WordPress audit logging for comment create, update, and approval events
Forward web server and application logs to a centralized analytics platform for retention and correlation
Baseline REST API traffic patterns and alert on request volume anomalies against the Kirki namespace

How to Mitigate CVE-2026-12723

Immediate Actions Required

Update the Kirki plugin to version 6.0.12 or later on all WordPress installations
Audit installed themes for bundled Kirki libraries and replace or patch them where present
Review existing comments for unauthorized modifications and restore from backup where tampering is confirmed
Rotate any credentials or contact channels referenced in fraudulent approved comments

Patch Information

The vendor released Kirki 6.0.12, which adds the missing authorization check to the affected REST route. Refer to the WPScan Vulnerability Report for advisory details and remediation guidance.

Workarounds

Restrict access to the /wp-json/kirki/ REST namespace at the web server or WAF layer until the plugin is upgraded
Disable or remove the Kirki plugin if it is not required by an active theme
Enforce comment moderation policies that require manual approval for all comments as a compensating control

bash

# Example: block unauthenticated access to Kirki REST routes at the Nginx layer
location ~ ^/wp-json/kirki/ {
    return 403;
}