The Kirki – Freeform Page Builder, Website Builder & Customizer plugin fails to verify that a caller has the necessary authorization before processing an email request. This missing capability check, identified as CWE‑862, lets an unauthenticated attacker provide arbitrary values for the emailSubject and emailBody parameters. The subject is only sanitized with a generic text filter, and the body can contain raw HTML or special ‘chip’ items that embed a genuine WordPress password‑reset link. Consequently the site’s mail server can be abused to send malicious, HTML‑rich phishing emails that appear to originate from the domain, potentially exposing user credentials and damaging the site’s reputation.

WordPress sites that have the Kirki plugin from themeum installed, on any version up to and including 6.0.11, are affected. The vulnerability is independent of the attacker’s role because the plugin performs no capability checks before handling the email request. reach can which may allow an unauthenticated visitor or a malicious actor to send phishing emails via the site’s mail server.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is a front‑end HTTP request from an unauthenticated user to the plugin’s internal email handling route. If exploited successfully, the attacker can send arbitrary HTML emails that abuse the site’s SPF/DKIM reputation, facilitating password‑reset phishing and other social‑engineering attacks.