What is GHSA-f5q9-9w7q-q2jv?

GHSA-f5q9-9w7q-q2jv is a security advisory published by GitHub Security Advisories with Medium severity. The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its...

Which CVE IDs does GHSA-f5q9-9w7q-q2jv cover?

GHSA-f5q9-9w7q-q2jv covers the following CVE IDs: CVE-2026-12723. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f5q9-9w7q-q2jv?

GHSA-f5q9-9w7q-q2jv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-f5q9-9w7q-q2jvMediumCVSS 5.3

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-12723 →

📋 Description

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12723
https://wpscan.com/vulnerability/76df2c61-4ba7-4987-9e61-5d02142b3db5
https://github.com/advisories/GHSA-f5q9-9w7q-q2jv