CVE-2026-12472

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.12

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to send arbitrary HTML-injected emails to registered users using the site's own mail server, leveraging its SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) reputation to bypass spam filters. The issue occurs because the emailSubject parameter is passed to the wp mail() function with insufficient sanitization, and emailBody text items are concatenated into the HTML body without escaping. Additionally, chip items can be used to embed legitimate WordPress password-reset links for targeted accounts.

Recommendations Update to version 6.0.12 or later.