Medium severity · published Jul 20, 2026
CVE-2026-12723
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kirki ·
before 6.0.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12723
wpscan.com
https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5/
More from Kirki
9.1
CVE-2026-13147
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
8.6
CVE-2026-12721
Kirki < 6.0.13 - Unauthenticated SQL Injection
7.5
CVE-2026-84219
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
7.5
CVE-2026-12720
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
6.8
CVE-2026-84223
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload