CVE-2026-12723

Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library

Medium · published July 20, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.2th percentile
Published
2026-07-20T06:00Z
EPSS history
Timeline
  • 20 JUL 06:00Z
    Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
    cvelistv5