The Kirki plugin for WordPress lacks a proper authorization check before processing email requests. As a result, any visitor—whether authenticated or not—can supply arbitrary values for the emailSubject and emailBody parameters. The subject receives only generic text filtering, while the body can contain raw HTML and special ‘chip’ items that embed operational links such as the genuine WordPress password‑reset URL. This flaw, categorized as CWE‑862, gives attackers a channel to send malicious, HTML‑rich phishing emails that appear to originate from the compromised site’s own mail server, thereby potentially compromising user credentials and damaging the site’s reputation.

WordPress installations running any Kirki version from themeum up to and including 6.0.11 are affected. These include sites that have not yet applied the recent patch that restores proper capability checks on the email interface.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a very low yet non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP request to the plugin’s internal email handling route, enabling a remote actor to issue arbitrary wp_mail() calls that abuse the site’s SPF/DKIM reputation for phishing.