Kirki < 6.0.12 - Unauthenticated Arbitrary Email Content Injection via emailBody and emailSubject Parameters

Description

The plugin is vulnerable to authorization bypass due to a missing authorization check on its email-sending action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled `emailSubject` parameter is passed to `wp_mail()` with only `sanitize_text_field()` applied, while `emailBody` 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.