CVE-2026-12724 Kirki CVE debrief

Who should care

Users of the Kirki WordPress plugin before version 6.0.12 should be aware of this vulnerability and take steps to protect themselves. This vulnerability could allow an attacker to inject malicious HTML into a password reset email, potentially leading to phishing attacks. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Technical summary

The Kirki WordPress plugin before 6.0.12 does not properly sanitize or escape user-supplied input in the email subject and body of password-reset emails. When an unauthenticated user requests a password reset, the plugin includes this unsanitized input in the email as HTML. This allows the attacker to inject arbitrary HTML code into the email, which can then be used for malicious purposes such as phishing. The vulnerability affects users of the Kirki WordPress plugin before version 6.0.12.

Defensive priority

High

Recommended defensive actions

• Update the Kirki WordPress plugin to version 6.0.12 or later
• Verify that all password reset emails are properly sanitized and escaped
• Monitor for suspicious password reset requests
• Implement additional security measures to prevent phishing attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T07:16:34.980Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Kirki WordPress plugin before 6.0.12 does not sanitize or escape email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user.

Official resources