Kirki WordPress Plugin Unauthenticated HTML Injection Vulnerability in Password Reset Email

A vulnerability exists in the Kirki WordPress plugin in versions prior to 6.0.12, where the plugin fails to properly sanitize or escape the email subject and body values before including them in the password reset email. This oversight allows unauthenticated users to inject arbitrary HTML into the message sent to registered users, potentially facilitating phishing attacks.

Impact

Exploitation of this vulnerability allows for unauthenticated HTML injection into password reset emails, which could be used to phish registered users.

Reproduction

To reproduce this vulnerability, first ensure that Kirki version 6.0.11 is active and that a public page is available that renders a Kirki forgot-password form element. This will expose the guest nonce needed for the injection. Next, scrape the guest X-WP-ELEMENT-NONCE from the forgot-password form page. With this nonce, send an unauthenticated POST request to the Kirki forgot-password endpoint via the WordPress REST API. Include a valid registered username and email address in the request, along with the injected HTML in the email subject and body. The injected HTML will be rendered unescaped in the email, which is sent to the specified registered user.

Remediation

Users are advised to update the Kirki WordPress plugin to version 6.0.12 or later.