Back to overview

CVE-2026-12723

MEDIUM Exploitation: PoC
5.3
CVSS 3.1
Description
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

Metadata

CVE ID
CVE-2026-12723
State
PUBLISHED
Assigner
WPScan
Reserved
2026-06-19 13:26 UTC
Published
2026-07-20 06:00 UTC
Last updated
2026-07-20 15:05 UTC
Primary CWE
CWE-862
CWE-862 Missing Authorization
Vendor / Product
Unknown / Kirki
Sources
cve.org  ·  NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Unknown Kirki — 0 < 6.0.12
Weakness (CWE)
CWESourceDescription
— cna CWE-862 Missing Authorization
CWE-862 adp CWE-862 Missing Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.3 MEDIUM 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References (1)
Back to overview