Kirki WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Comment Modification and Moderation Bypass

A vulnerability exists in the Kirki WordPress plugin in versions prior to 6.0.12, where one of its REST routes lacks proper authorization checks. This flaw enables unauthenticated users to overwrite the content of existing comments and to create pre-approved comments under a false identity, circumventing the comment moderation process.

Impact

Exploitation of this vulnerability allows for unauthorized modification of existing comments and the creation of new comments that bypass moderation, potentially leading to the spread of misinformation or spam.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/KirkiComponentLibrary/v1/kirki-comment' REST route without authentication. After scraping a nonce from a public page, this nonce can be used to overwrite an existing comment or to insert a new comment under a spoofed identity, bypassing moderation.

Remediation

Users are advised to update the Kirki WordPress plugin to version 6.0.12 or later.